There's a special kind of dread in seeing "ShinyHunters" attached to your company's name in a headline. It's the extortion group's equivalent of a Michelin star — except the thing they're rating is how badly they just wrecked your week.
623 Gigabytes, One Very Convincing Phone Call
RingCentral disclosed in late July that attackers had compromised its systems via what the company called a "sophisticated social engineering campaign." ShinyHunters claimed responsibility, saying it made off with 623GB of data. When RingCentral declined to pay the ransom, the group followed through on its threat, publishing a 280GB archive on its dark web leak site. Have I Been Pwned confirmed the fallout this week: personal information tied to 1.6 million accounts, including names, emails, phone numbers, and physical addresses, is now circulating.
RingCentral has been careful to draw a line around the damage, stating the core platform and services were never disrupted and that "if you are not contacted by RingCentral, you are not affected." Small comfort if you're one of the 1.6 million who were.
The Firewall Was Never the Weak Point
Notice what's absent from this story: a zero-day, a misconfigured server, an unpatched vulnerability. This breach happened because someone talked their way past a human being. Social engineering keeps winning because it targets the one part of a security stack that can't be patched with an update.
ShinyHunters has made a habit of this exact playbook this year — pick a company with a big enough customer list, get in through people rather than code, then use the leaked data itself as leverage. It works precisely because most incident response plans are built around technical intrusions, not a convincing phone call to the help desk.
Your firewall doesn't need a vacation. Your help desk script might.
If your team has never actually rehearsed what a social engineering attempt looks like in practice, that's worth fixing before you're the next name in this headline — let's talk about shoring that up.
Source: BleepingComputer