What to Do After the RingCentral Data Breach (August 2026)

RingCentral disclosed a July 2026 breach on July 28 after the ShinyHunters extortion group dumped data on approximately 1.6 million accounts on August 14, 2026. Compromised information includes names, email addresses, phone numbers, and physical addresses; no passwords, call content, or financial data have been reported exposed. If you or your business have ever used RingCentral, expect targeted phishing and SIM-swap attempts — rotate 2FA off SMS, watch for vishing calls impersonating IT support, and remove your data from broker sites so attackers cannot cross-reference the leak.

What Happened in the RingCentral Data Breach?

The timeline:

• July 2026: ShinyHunters gained access to RingCentral systems via a social engineering attack — the same IT-helpdesk-themed vishing playbook the group has used against dozens of enterprises in 2026.
• July 27, 2026: ShinyHunters claimed responsibility and demanded a ransom from RingCentral.
• July 28, 2026: RingCentral detected the unauthorized activity, engaged a third-party forensic firm, and publicly disclosed the breach.
• August 14, 2026: After RingCentral apparently refused the ransom, ShinyHunters dumped the stolen data online. Approximately 1.6 million accounts are represented in the dump.

RingCentral has said the incident affected "a limited portion" of customers, that the core RingCentral platform was not impacted, and that the company is contacting affected users directly. If you are not contacted, RingCentral has said you are not affected — but given the leak is public, treat any RingCentral exposure as potentially in the dump.

What Data Was Exposed?

Confirmed by RingCentral and independent breach analysts reviewing the dump:

• Full names
• Email addresses
• Phone numbers
• Physical addresses

Not exposed (per current disclosure):

• Passwords or password hashes
• Call recordings or message content
• Payment card or bank information
• Social Security numbers

Are You Affected?

Assume affected if:

• You receive a direct notification from RingCentral in July or August 2026
• Your organization uses (or recently used) RingCentral for phones, meetings, or contact center
• You created a RingCentral account — even a trial — and provided a phone number or address
• Your email address appears in Have I Been Pwned's RingCentral breach entry

Check your email at haveibeenpwned.com to confirm.

Immediate Steps to Take

Step 1: Move 2FA Off SMS

The most likely follow-on attack from a phone-number leak is a SIM swap: an attacker convinces your carrier to port your number to their SIM, then intercepts SMS 2FA codes to take over your accounts. On every account that offers a choice — especially email, banking, brokerage, crypto, and your RingCentral admin console — switch 2FA from SMS to an authenticator app (Google Authenticator, Authy, 1Password, Bitwarden) or a hardware security key (YubiKey, Google Titan). Then call your mobile carrier and add a port-out PIN or SIM-swap block.

Step 2: Watch for Vishing (Voice Phishing)

ShinyHunters' 2026 playbook is voice-first: they call posing as IT helpdesk staff and talk victims into approving fake MFA prompts or handing over session tokens. Expect the same to hit RingCentral customers. Rules for you and your team this week:

• No one from IT will ever ask you to approve an MFA prompt while on the phone
• Any inbound call from "support" gets hung up and called back on the number listed on the official website, never the number they gave
• If you feel pressured or rushed, that is the attack — stop the call

Step 3: Rotate Any Passwords You Reused on RingCentral

Passwords were not part of the RingCentral dump, but if you reused a RingCentral password anywhere else, rotate it now — ShinyHunters have a history of credential-stuffing after their leaks. Use a password manager to generate unique passwords per site.

Step 4: Consider a Credit Freeze

SSNs did not leak here, so credit freezes are lower priority than for SSN-heavy breaches like Farmers Insurance or Allstate. But if your name + address + phone appear in ShinyHunters' dump, a free credit freeze at all three bureaus adds a cheap belt-and-suspenders layer against future combined leaks. Free and reversible at Equifax, Experian, and TransUnion.

Step 5: Alert Your Coworkers and Family

Business phone leaks turn into targeted phishing not just against you but against your coworkers and family who share your work relationships. Give them the 30-second warning: "There was a RingCentral leak, I may get impersonated in a call or email, verify any weird request with me before acting on it."

Cut the Trail: Remove Your Data From Broker Sites

The RingCentral leak by itself gives attackers your contact info. It becomes far more dangerous when paired with data-broker records — relatives, past addresses, employers, court records — which they can buy for pennies on Spokeo, BeenVerified, Whitepages, and 100+ similar sites. Removing your data from those brokers breaks the chain: when a ShinyHunters affiliate looks you up after the RingCentral dump and finds nothing on the public web, most give up and move to easier targets.

For RingCentral Admins: Extra Steps

• Rotate any long-lived API keys or SSO tokens tied to your RingCentral tenant — the incident affected support and account data, and long-lived credentials should be treated as compromised out of caution
• Review admin audit logs for any unfamiliar admin actions since June 2026
• Force password reset for all users and require MFA re-enrollment on non-SMS methods
• Send an internal warning to staff about the vishing risk so no one falls for an IT-helpdesk impersonator this week
• Contact your RingCentral CSM for the official incident-response Q&A packet if you have not received it

Longer-Term Protection

• Use email aliases for new B2B signups (iCloud Hide My Email, Firefox Relay, DuckDuckGo Email Protection) so one leak doesn't burn your primary inbox
• Add dark-web monitoring for your email and phone number so you know when they appear in new dumps
• Set fraud alerts at all three credit bureaus as a low-effort supplement to a freeze
• Report suspected identity theft at IdentityTheft.gov if you see account takeovers
• Audit every service where your work email is the login and add non-SMS 2FA on the important ones

Frequently Asked Questions

Is the RingCentral 2026 data breach confirmed?

Yes. RingCentral publicly disclosed the incident on July 28, 2026 after ShinyHunters claimed responsibility on July 27. On August 14, 2026 ShinyHunters dumped data on approximately 1.6 million accounts — names, email addresses, phone numbers, and physical addresses. RingCentral engaged a third-party forensic firm and is notifying affected customers directly.

How many people were affected by the RingCentral breach?

Roughly 1.6 million accounts appear in the ShinyHunters dump released on August 14, 2026. RingCentral has described the exposure as "a limited portion" of its customer base but has not published a precise number of individuals versus accounts.

Were RingCentral call recordings or messages exposed?

No. According to current RingCentral disclosures, no call content, meeting recordings, chat messages, passwords, or payment data were part of the incident. The exposed data is limited to account contact information.

What is the biggest risk from the RingCentral leak?

SIM swaps and vishing (voice-phishing) attacks. ShinyHunters specialize in phone-based social engineering, and the leak gives them your real name, real phone number, and real address — enough to run convincing IT-helpdesk impersonation calls. Move 2FA off SMS and treat any inbound "support" call with extreme skepticism this month.

Do I need to freeze my credit after the RingCentral breach?

Credit freezes are lower priority for RingCentral than for SSN-heavy breaches, because SSNs were not exposed. But a credit freeze is free, reversible, and adds cheap protection against future breaches that may combine with this data. If you have not frozen your credit anywhere, this is a good excuse to do it now.

Is there a service that can shrink my exposure after a breach like this?

Yes — PrivacyOn is our top pick. It removes your personal information from 100+ data broker sites so attackers cannot cross-reference the RingCentral leak with your current address, relatives, and employer, adds 24/7 dark web monitoring to alert you when your info surfaces in new dumps, and covers up to 5 family members from $8.33/month. Breach-response monitoring only alerts you after fraud has already happened; PrivacyOn shrinks the exposed surface first, which is what stops most opportunistic attackers.

How can I check if my data is in the RingCentral leak?

The leak was indexed by Have I Been Pwned shortly after the ShinyHunters dump. Enter your email address at haveibeenpwned.com to check. RingCentral is also notifying affected users directly, so watch your inbox — and watch for phishing pretending to be that notification.

Can I sue RingCentral over the 2026 breach?

Several plaintiffs' firms announced investigations into potential class actions in August 2026. If you are affected, save any notification letter or email from RingCentral and any related correspondence; you may qualify to join a class action later. This is not legal advice — consult an attorney for your situation.