--- title: A phone company just lost 1.6 million records to a phone... description: ShinyHunters leaked 1.6 million RingCentral customer records after voice-phishing a single employee out of credentials, with no exploit or software... canonical: https://daily.dev/posts/a-phone-company-just-lost-1-6-million-records-to-a-phone-call-lst6dttex twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A phone company just lost 1.6 million records to a phone call | daily.dev og:description: ShinyHunters leaked 1.6 million RingCentral customer records after voice-phishing a single employee out of credentials, with no exploit or software... og:url: https://daily.dev/posts/a-phone-company-just-lost-1-6-million-records-to-a-phone-call-lst6dttex og:image: https://api.daily.dev/og/posts/LsT6dTTex.png og:image:alt: A phone company just lost 1.6 million records to a phone call og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A phone company just lost 1.6 million records to a phone call **[The Next Web](https://daily.dev/sources/tnw)** · 6 min read · 0 upvotes · 0 comments ## Summary ShinyHunters leaked 1.6 million RingCentral customer records after voice-phishing a single employee out of credentials, with no exploit or software vulnerability involved. RingCentral disclosed the intrusion on 28 July, calling it a sophisticated social engineering campaign affecting a limited portion of customers, while ShinyHunters says it dumped over 623GB after RingCentral refused to pay an extortion demand. The same group hit Ernst & Young, Abbott's diagnostics business, Levi Strauss, and used an Oracle PeopleSoft zero-day against over 100 universities. Voice phishing is described as a low-cost, unpatchable attack vector now used against major finance firms like Blackstone, KKR and CME, with the article framing stolen contact data as fuel for future social engineering attacks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did ShinyHunters breach RingCentral and steal 1.6 million records? ShinyHunters voice-phished a RingCentral employee into granting access, with no software exploit or unpatched vulnerability involved. The group claimed over 623GB of data, listed RingCentral on its leak site on 27 July with a 30 July payment deadline, and published the data on 3 August after RingCentral refused to pay. RingCentral says only a limited portion of customers was affected and the core platform was untouched. _Security teams tracking social-engineering breach patterns follow incidents like this on daily.dev._ ### What other companies has the ShinyHunters hacking group targeted recently? ShinyHunters has hit hundreds of organizations since January, including Ernst & Young, Abbott's cancer diagnostics business (10.9 million email addresses), the Moody Bible Institute (2.3 million accounts), Medtronic, and Levi Strauss via the same voice-phishing method. It also exploited an unpatched Oracle PeopleSoft zero-day rated 9.8 severity to breach over 100 organizations, mostly universities, in June. _Anyone mapping threat actor activity across industries can follow ShinyHunters coverage on daily.dev._ ### Why is voice phishing (vishing) considered a cheaper and more persistent attack method than exploiting a zero-day vulnerability? A zero-day requires research and stops working once a patch ships, while a phone call costs nothing and never stops working because it targets a person rather than software. Voice phishing has become mainstream against sophisticated targets like Blackstone, KKR and CME, using nothing more advanced than a telephone call to persuade an employee to grant access. _Teams weighing patch management against human-risk training can track this trade-off on daily.dev._ ## Similar posts on daily.dev - [Phishing service spoofs RingCentral to steal Microsoft 365 accounts](https://daily.dev/posts/phishing-service-spoofs-ringcentral-to-steal-microsoft-365-accounts-ajuhddfzc) · BleepingComputer · 0 upvotes · 0 comments - [Voice phishing skyrockets as smooth crims talk their way in](https://daily.dev/posts/voice-phishing-skyrockets-as-smooth-crims-talk-their-way-in-tjdntlll8) · The Register · 0 upvotes · 0 comments - [Cybercriminals claim breach of Oracle PeopleSoft servers at 100-plus organizations](https://daily.dev/posts/cybercriminals-claim-breach-of-oracle-peoplesoft-servers-at-100-plus-organizations-pjb82lsrq) · TechCrunch · 0 upvotes · 0 comments - [Oracle PeopleSoft zero‑day fuels ShinyHunters extortion spree](https://daily.dev/posts/oracle-peoplesoft-zero-day-fuels-shinyhunters-extortion-spree-fytdsgnoy) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#phishing](https://daily.dev/tags/phishing), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/a-phone-company-just-lost-1-6-million-records-to-a-phone-call-lst6dttex) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A phone company just lost 1.6 million records to a phone call","url":"https://daily.dev/posts/a-phone-company-just-lost-1-6-million-records-to-a-phone-call-lst6dttex","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-phone-company-just-lost-1-6-million-records-to-a-phone-call-lst6dttex"},"datePublished":"2026-08-15T12:33:05.473Z","dateModified":"2026-08-15T12:44:11.215Z","description":"ShinyHunters leaked 1.6 million RingCentral customer records after voice-phishing a single employee out of credentials, with no exploit or software...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e071f46fd4e4655df320b00e1ea4b559?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e071f46fd4e4655df320b00e1ea4b559?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-phone-company-just-lost-1-6-million-records-to-a-phone-call-lst6dttex","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,phishing,data-breach","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"A phone company just lost 1.6 million records to a phone call"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-phone-company-just-lost-1-6-million-records-to-a-phone-call-lst6dttex#faq","mainEntity":[{"@type":"Question","name":"How did ShinyHunters breach RingCentral and steal 1.6 million records?","acceptedAnswer":{"@type":"Answer","text":"ShinyHunters voice-phished a RingCentral employee into granting access, with no software exploit or unpatched vulnerability involved. The group claimed over 623GB of data, listed RingCentral on its leak site on 27 July with a 30 July payment deadline, and published the data on 3 August after RingCentral refused to pay. RingCentral says only a limited portion of customers was affected and the core platform was untouched. Security teams tracking social-engineering breach patterns follow incidents like this on daily.dev."}},{"@type":"Question","name":"What other companies has the ShinyHunters hacking group targeted recently?","acceptedAnswer":{"@type":"Answer","text":"ShinyHunters has hit hundreds of organizations since January, including Ernst & Young, Abbott's cancer diagnostics business (10.9 million email addresses), the Moody Bible Institute (2.3 million accounts), Medtronic, and Levi Strauss via the same voice-phishing method. It also exploited an unpatched Oracle PeopleSoft zero-day rated 9.8 severity to breach over 100 organizations, mostly universities, in June. Anyone mapping threat actor activity across industries can follow ShinyHunters coverage on daily.dev."}},{"@type":"Question","name":"Why is voice phishing (vishing) considered a cheaper and more persistent attack method than exploiting a zero-day vulnerability?","acceptedAnswer":{"@type":"Answer","text":"A zero-day requires research and stops working once a patch ships, while a phone call costs nothing and never stops working because it targets a person rather than software. Voice phishing has become mainstream against sophisticated targets like Blackstone, KKR and CME, using nothing more advanced than a telephone call to persuade an employee to grant access. Teams weighing patch management against human-risk training can track this trade-off on daily.dev."}}]} ```