[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_ajHHPl4h0wMRV2zfpSBv78LgVPkqu3zdQ3Yws4KLZc":3},{"article":4,"iocs":39,"watch_terms":44,"solutions":45,"lesson":132},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"140c582b-2706-411a-9c16-4db624bd2ec9","RingCentral data breach exposed info of 1.6 million accounts","ringcentral-data-breach-exposed-info-of-1-6-million-accounts-815fb6","The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in July, according to the data breach notification service Have I Been Pwned. [...]","The ShinyHunters extortion group has claimed responsibility for a data breach at RingCentral, a cloud-based communication platform. The group alleges to have stolen 623GB of data, including personal information for 1.6 million accounts, which they subsequently leaked on their dark web site after RingCentral refused to pay a ransom. Have I Been Pwned has confirmed the leaked data contains records such as names, email addresses, phone numbers, and physical addresses.","ShinyHunters group claims to have stolen data of 1.6 million RingCentral accounts.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fringcentral-data-breach-exposed-info-of-16-million-accounts\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F14\u002FRingCentral-headpic.jpg","2026-08-14T10:52:05+00:00","2026-08-14T12:00:18.642037+00:00",8,[17,20,23],{"name":18,"type":19},"RingCentral","vendor",{"name":21,"type":22},"ShinyHunters","threat_actor",{"name":24,"type":25},"Oracle PeopleSoft","product","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":26,"icon":28,"name":29,"slug":30},null,"Breaches","breaches",[32,34],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[40],{"type":41,"value":42,"context":43},"malware","Oracle PeopleSoft zero-day flaw","Exploited by ShinyHunters in other recent attacks.",[18,24],{"controls":46,"vendors":131},[47,76,102],{"slug":48,"name":49,"problem":50,"products":51},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":77,"name":78,"problem":79,"products":80},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":98,"product_name":99,"url":100,"description":101},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":103,"name":104,"problem":105,"products":106},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",[],{"slug":133,"title":134,"body":135,"framework_refs":136,"framework_notes":147},"shinyhunters-leaks-16m-ringcentral-accounts-after-ransom-refusal","ShinyHunters Leaks 1.6M RingCentral Accounts After Ransom Refusal","The ShinyHunters group exfiltrated 623GB of sensitive customer data from RingCentral, including names, email addresses, phone numbers, and physical addresses for 1.6 million accounts. When RingCentral refused to pay a ransom, the attackers publicly leaked the data on a dark web site, maximizing harm to affected individuals. This incident highlights the dual risk of ransomware-style extortion: paying does not guarantee data destruction, but refusing can result in full public exposure of customer records. Cloud communication platforms hold vast amounts of sensitive personal data, making them high-value targets that require robust data minimization, encryption, and breach response capabilities. The public confirmation via Have I Been Pwned underscores how quickly stolen data circulates and reaches threat intelligence communities.",[137,138,139,140,141,142,143,144,145,146],"CIS Control 3 – Data Protection","CIS Control 17 – Incident Response Management","NIST SP 800-53 SI-12 – Information Management and Retention","NIST SP 800-53 IR-4 – Incident Handling","NIST SP 800-53 SC-28 – Protection of Information at Rest","GDPR Article 5(1)(c) – Data Minimisation","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","NIST CSF DE.CM-1 – Network Monitoring","ISO\u002FIEC 27001:2022 A.5.29 – Information Security During Disruption",{}]