Genesys Hack Exposes Customer Data From Internal Systems

What it is

Genesys, a Menlo Park, California provider of customer experience and call center software, announced on October 19, 2026 that attackers had accessed its internal business systems, including a learning management system (LMS) and a CRM environment. It declared the incident contained on October 23. A group called ScarlettGroup has claimed the attack on its leak site, but Genesys has not named the attacker.

Preconditions / Affected

The exposed data is Genesys's own business and account information, used to manage relationships with existing and prospective customers. The page says the attackers accessed and likely downloaded names, phone numbers, business email addresses, job titles, company and account information, and "other customer interaction information". The last category is not defined.

Genesys says Genesys Cloud, Genesys Engage and Genesys Engage Cloud were not compromised. It also says there was no unauthorized access to customer or partner environments, or to data stored or processed in those platforms. This is the company's own statement, not an independent finding.

What to do

The page gives one customer action: watch for messages impersonating Genesys. Genesys says it will never ask for sensitive information such as passwords by email or other unsolicited channels. The exposed contact data (names, roles, business emails, phone numbers, account details) is the kind that makes targeted phishing or vishing credible, so staff who deal with Genesys account teams are the likely targets.

Containment included suspending the LMS platform. Customers who use Genesys training content may see that service affected.

Caveats

As of Friday, October 23, the investigation into scope and impact was still ongoing. Genesys promised more detail once it has reviewed the accessed information and confirmed material facts. The page does not say how many customers are affected, how the attackers got in, or what ScarlettGroup claims to hold.