RingCentral

Overview

RingCentral (NYSE: RNG) is an American cloud-communications company whose platforms provide voice, messaging, contact-center, and workforce-engagement tools to more than 600,000 businesses (TipRanks; National Cyber Security Consulting). Founded and led by CEO Vlad Shmunis, the company spent 2026 on two sharply contrasting tracks: a financial maturation marked by its first-ever dividend, and one of the year’s most symbolically charged corporate breaches (TipRanks; National Cyber Security Consulting).

The phone company hacked by phone call

In July 2026, the cybercriminal extortion group ShinyHunters added RingCentral to its Tor-hosted dark-web leak site, claiming to have stolen more than 623 gigabytes of data and setting a July 30 payment deadline (National Cyber Security Consulting). RingCentral publicly disclosed the intrusion on July 28, describing it as a “sophisticated social engineering campaign,” and did not pay the extortion demand; on August 3, ShinyHunters published a compressed 280-gigabyte archive of the claimed stolen files (National Cyber Security Consulting).

According to The Register, a ShinyHunters spokesperson said the group gained entry by voice-phishing a RingCentral employee — calling them on the phone and persuading them to hand over their password (National Cyber Security Consulting). The irony is structural: RingCentral’s core product is business phone infrastructure, and it was breached through the very channel it sells to 600,000 businesses (National Cyber Security Consulting).

On August 13, the breach-notification service Have I Been Pwned independently analyzed the archive and added approximately 1.6 million unique email addresses to its database — each accompanied by the account holder’s full name, phone number, and physical address (National Cyber Security Consulting). That four-element combination is precisely what an attacker needs to run a convincing impersonation call — meaning the breach effectively packaged a vishing toolkit targeting the customers of a voice-communications company, using the same technique that produced it (National Cyber Security Consulting).

RingCentral told customers that “if you are not contacted by RingCentral, you are not affected,” but the company has neither confirmed nor denied HIBP’s 1.6 million figure and has not disclosed how many individuals it directly notified (National Cyber Security Consulting).

The maturing business: first dividend, AI pivot

Months before the breach, RingCentral reported a financial profile of unusual maturity for a growth-era SaaS company. Full-year 2025 revenue reached $2.52 billion (up 5%), with subscriptions exceeding 95% of sales; GAAP operating margin expanded to 4.8%, and the company generated record free cash flow of $530 million while cutting net leverage to 1.7 times (TipRanks).

On February 19, 2026, the board approved the company’s first cash dividend — $0.075 per share quarterly — and raised the share-repurchase authorization to $500 million, signaling a deliberate shift toward returning capital to investors (TipRanks). Operationally, AI-led products reached $100 million in annual recurring revenue, with the AI Receptionist serving more than 8,000 customers, and the company deepened its AI capabilities through an integration with OpenAI (TipRanks).

In the UCaaS market itself, RingCentral retained its Leader position in Gartner’s 2026 Magic Quadrant — its twelfth consecutive year — alongside Cisco, Microsoft, and Zoom, with Gartner crediting close to 600 prebuilt integrations and the new AIR Pro agentic tool while cautioning that midlevel pricing sits above the market average (UC Today).

What this profile does not claim

This profile does not confirm RingCentral’s own characterization of the breach’s scope — the “limited portion” framing conflicts with HIBP’s independent 1.6 million figure, which the company has neither confirmed nor denied. It does not verify the reported Q2 2026 dividend increase, which appears only in company-release reposts. Founding history and headquarters city were not covered by the fully read sources. Financial figures reflect the cited reporting periods and may have changed.