RingCentral Data Breach Affects 1.6 Million Accounts

RingCentral, the cloud platform for corporate communications used by more than 600,000 companies for calls, messaging and voicemail, has fallen victim to a ransomware attack. According to the breach-notification service Have I Been Pwned, the attackers obtained the personal data of 1.6 million accounts.

The company itself disclosed the incident on July 28, describing it as the result of a “sophisticated social engineering campaign.” RingCentral stresses that only a limited portion of its customers was affected, that the core platform was not compromised and that its services continue to run without interruption. Those affected are being notified directly: “If RingCentral hasn’t contacted you, then you weren’t affected.”

What is known about the breach

The company has not officially named those responsible, nor has it disclosed the details of the intrusion. However, the ShinyHunters group claimed responsibility for the July 27 attack, saying it had stolen 623 GB of data. After RingCentral refused to pay a ransom to have the stolen material destroyed, the extortionists posted a compressed 280 GB archive on their dark web site.

Have I Been Pwned analyzed the leaked data and confirmed its authenticity: the records contain the names, email addresses, phone numbers and physical addresses of 1.6 million people.

Serial extortionists

Over the past year, ShinyHunters have become one of the most prominent players in this arena. The group has claimed to have breached hundreds of Salesforce customers, asserting that it stole more than 1.5 billion records in campaigns against Salesloft Drift and Salesforce Aura. It has also been linked to attacks on more than a dozen Snowflake customers and on various third-party integration providers.

More recently, ShinyHunters took credit for a new wave of breaches affecting more than a hundred organizations — this time by exploiting a zero-day vulnerability in Oracle PeopleSoft. Exactly how the attackers got into RingCentral’s systems, the company has yet to say.

Source: Bleeping Computer