Threatline

RingCentral - 1,596,490 breached accounts

In July 2026, the cloud-based business communications platform . The group subsequently published data they claimed was obtained from the platform, which included 1.6M unique email addresses along with names, physical addresses and phone numbers. , RingCentral advised that the incident affected "a limited portion of RingCentral customers" and that it was communicating directly with those affected. RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign In their disclosure notice