If you have been told your information was caught up in the RingCentral or ADT data breach, you are probably wondering what a dark web leak actually means and whether you need to panic. You don't need to panic, but you do need to act. Here is what we know, and what to do next.
What actually happened
ADT, the home security company, confirmed a breach after a cybercrime group stole customer data and tried to extort the company. When ADT refused to pay, the group published an 11GB archive on its dark web leak site. Have I Been Pwned analyzed the stolen files and found records for 5.5 million people, including names, dates of birth, phone numbers, physical addresses, email addresses, and partial government-issued ID numbers. ADT has said no payment information was accessed and that customer security systems themselves were not compromised.
RingCentral, a cloud communications platform used by more than 600,000 businesses for calling, messaging, and voicemail, disclosed its own breach on July 28. The extortion group ShinyHunters claimed responsibility. After RingCentral refused to pay a ransom, the group leaked a 280GB archive on its dark web leak site. Have I Been Pwned confirmed the data covered 1.6 million accounts, including names, email addresses, phone numbers, and physical addresses.
LexisNexis, a major data broker that holds consumer and background-check records, is often mentioned in current discussion of breach activity. We could not independently verify a specific new LexisNexis leak from a confirmed source at the time of writing, so we are not citing any figures or details for it here. If you believe you were affected by a LexisNexis incident, check directly with LexisNexis through its official site and with a breach-notification service rather than relying on secondhand claims.
Why stolen data ends up on a dark web leak site
These groups follow a pattern: break into a company's systems, copy large amounts of customer data, then demand payment to delete it and stay quiet. When the company refuses, as both ADT and RingCentral did, the group publishes the stolen archive on a leak site hosted on the dark web to pressure future victims and punish the refusal.
A dark web leak site is a website reachable through Tor. Hosting it there makes it harder to take down quickly, though not impossible. It does not make the stolen data more dangerous in itself, but it does mean the data is sitting somewhere awkward to monitor and easy for other criminals to download and reuse.
What this means if you were affected
The data exposed in these breaches-names, dates of birth, phone numbers, home addresses, email addresses, and in ADT's case partial ID numbers-is exactly what criminals use for identity theft, SIM-swap attempts, and convincing phishing messages. No payment card data was reported stolen in the ADT case, which limits some risks, but the personal details alone are enough to impersonate you or target you with scams that reference real information about you.
Millions of records does not mean every single record will be misused. But you should assume your own data could be, and plan accordingly rather than hoping you're one of the ones who gets missed.
Steps to take right now
- Check a reputable breach-notification service such as Have I Been Pwned to see which of your email addresses or accounts appear in confirmed breaches.
- Change the password on the affected account, and on any other account where you reused that password.
- Turn on two-factor authentication wherever it's offered, preferably with an authenticator app rather than SMS codes.
- Watch for phishing emails, texts, and calls that reference your real name, address, or account details. A breach gives scammers the kind of detail to sound convincing.
- If your government ID information may have been exposed, as reported in the ADT case, consider a credit freeze with the major credit bureaus to make it harder for someone to open accounts in your name.
- Be skeptical of anyone claiming to be from ADT, RingCentral, or LexisNexis who contacts you asking to "verify" personal details after a breach. Confirm independently through the company's official channels.
Should you try to view the leak yourself?
We don't recommend it. Visiting a criminal leak site serves no practical purpose for an individual trying to protect themselves, and it carries real risks: malware, scams dressed up as "checker" tools, and sites that are unreliable or fake.
Tor Browser, made by the Tor Project, is a legitimate privacy tool, but Tor does not make any action anonymous by itself. What you do while using it, such as logging into a personal account, still identifies you. Using Tor to visit a criminal leak site adds risk without adding any real protection for your data.
A related caution: if you search for "the dark web" generally, you will likely run into Hidden Wiki-style directories. No single trustworthy version exists anymore. What you'll find is clones full of outdated, fake, or outright dangerous links. None of them are a safe starting point for checking on a breach.
The reliable path is a dedicated breach-notification service, or a direct statement from the company itself on its official site.
Building better habits going forward
Use a password manager so each account has a unique password, which limits the damage any single breach can cause. Consider an email alias or a privacy-respecting provider like Proton Mail for accounts where you don't want your main address exposed again. For everyday searching, use a search engine that doesn't log your queries, such as DuckDuckGo, to reduce how much of your activity gets tied back to you.
None of this prevents a company from being breached. What it does is reduce how much a single leak, whether from RingCentral, ADT, or the next company in the news, can expose about the rest of your digital life.