Genesys says intruders accessed internal systems, Cloud platforms unaffected

An unauthorized third party accessed Genesys’s internal business systems, the company said on October 19, 2026, and Genesys said it contained the cyberattack. Genesys is based in Menlo Park, California, and sells contact-center and call-center technology to midsize and large businesses.

Genesys said the intruders reached internal systems such as a learning management system and a customer relationship management platform. Potentially compromised data includes names, phone numbers, job titles, corporate email addresses, company and account details, and other details linked to customer dealings. The intruders obtained and probably copied data used to handle relationships with current and potential customers. Genesys named only the learning management system and CRM as affected internal systems, and said the word including leaves open other systems without naming them.

The affected systems held business and account information used to manage relationships with existing and prospective customers.

Genesys confirmed the Genesys Cloud, Genesys Engage and Genesys Engage Cloud platforms were not compromised, and no customer or partner data in them was accessed. Call recordings and analytics data in those platforms were not affected by the incident. “We have confirmed that the Genesys Cloud, Genesys Engage and Genesys Engage Cloud platforms were not compromised,” Genesys said.

Genesys deployed containment measures including suspending the learning management system platform. Genesys announced on October 23, 2026, that the intrusion had been fully contained. “Genesys has fully contained the intrusion and incident,” Genesys said. Genesys said it believes the unauthorized activity is contained and that it sees no sign of continued unauthorized access, and its review of what was accessed is continuing with details to be shared once important facts are confirmed.

Genesys became aware of the incident on October 16, 2026, and its security team launched an investigation after it learned of the unauthorized access. Genesys said on October 19, 2026, that intruders entered internal business systems such as a learning management system and a customer database for managing client relationships. The company announced the incident on October 19, 2026. Safeguard said reports disagreed on the disclosure date, describing an October 16 disclosure claim versus Genesys’s October 16 awareness date and October 19 notice date, while DataBreach.com’s investigation team puts the attack at October 16, 2026.

As of October 23, 2026, Genesys had not said publicly who was behind the incident, how the intruders got in, or when the access happened. The company had not said how many records were involved or which products the systems used, and it had not said whether individuals would be notified, whether law enforcement was involved, or what indicators of compromise existed.

A recently emerged group called ScarlettGroup claimed the attack on its leak site, and DataBreach.com said these attacker claims have not been independently verified. ScarlettGroup claimed it stole CRM data, training system material, signed agreements, contracts, financial documents, and customer records. The group also claimed access to learner accounts with password hashes; Genesys has not confirmed these claims.

DataBreach.com’s investigation team counted about 3.86 million email addresses tied to the ScarlettGroup listing, about 3.2 million names, about 2.04 million phone numbers, about 485,000 street addresses and about 18,100 birthdays. DataBreach.com said not every individual is affected by every data type, and Genesys has not confirmed these figures.

Safeguard noted that CRM interaction details can include items such as meeting notes, renewal dates, or support history in typical systems, and described these points as general context, not a confirmed description of Genesys’s systems. Customers should assume exposure because anyone could know what was shared with Genesys account teams, Safeguard said.

Genesys told customers to watch for suspicious messages mentioning Genesys, follow security best practices, and check Genesys’s recommended practices and resources for its platform. Safeguard recommends that customers verify the breach scope with Genesys, reset passwords on Genesys training or learning accounts and anywhere those passwords were reused, turn on multifactor authentication, and watch financial accounts for unfamiliar activity.