For: staff at companies that use Genesys products or have dealt with Genesys sales or training, and contact-center and IT administrators. This article is based on Genesys's official announcement and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
- Who is affected
staff at companies that use Genesys products or have dealt with Genesys sales or training, and contact-center and IT administrators.
- Confirmed so farSee the table ↓
- Unauthorised access to and/or download of information in the LMS and CRM
- Date the company became aware
- Containment
- Not yet confirmed
- Number of people whose information was accessed
- Which items were taken for each person
- How the intrusion happened
2 more
- Whether individuals will be notified
- Whether the information has been published or misused
- What to do nowSee the steps ↓
- Treat Genesys-themed requests for passwords or sensitive information as fake
- Confirm through a channel you already use
- Tell the colleagues who are named contacts with Genesys
1 more
- Review the recommended security practices for your platform
- Where to verify (source)All sources ↓
- Genesys, "Security Update: Incident Affecting Certain Genesys Internal Business Systems" (October 19, 2026, updated October 23, 2026)
- Last checked
- As of October 31, 2026
Follow-up plans and what we checked
In its October 23 update, Genesys wrote that it continues to review the information accessed from certain internal systems to determine the scope and impact, and will provide additional updates as material facts are confirmed. As of October 31, the announcement page shows no update after October 23.
What customers and their staff should do today
Treat Genesys-themed requests for passwords or sensitive information as fake
With names, business email addresses, phone numbers and job titles together, someone can write a message that looks like it comes from your Genesys account team or training. Genesys says it will never ask customers to provide passwords or other sensitive information through email or unsolicited channels, and encourages customers to remain alert for suspicious communications referencing Genesys.
A message that knows your job title and company is not proof that it is genuine. Do not reply, open attachments or click links in such messages (how to spot them: What is phishing?).
Confirm through a channel you already use
If a message asks you to sign in, renew a contract, complete training or change payment details, contact your account team or support through the channel you already use, or sign in to your platform by typing the address yourself. Do not use phone numbers or links in the message.
Tell the colleagues who are named contacts with Genesys
The information involved is about existing and prospective customers. At your company, that is likely to be the platform administrators, the people who bought or evaluated the product, and staff who took training. Let them know that messages mentioning Genesys may be targeted at them.
Review the recommended security practices for your platform
Genesys encourages customers to review the recommended security practices and resources available for their Genesys platform. The company says the platform itself was not compromised, so this is a precaution, not a response to platform access. Checking that administrator accounts use multi-factor authentication is a sensible first step in general (see: Multi-factor authentication guide).
What happened (from Genesys's announcement)
The following is based on the security update Genesys published on October 19, 2026 and updated on October 23.
October 16, 2026
Genesys becomes aware of a cybersecurity incident involving an unauthorised third party, and its security team starts an investigation.October 19
Genesys publishes its security update. It says certain internal business systems, including an LMS and a CRM platform, were accessed, and that the Genesys Cloud, Genesys Engage and Genesys Engage Cloud platforms were not compromised.October 23
Update: the company says the intrusion has been fully contained, immediate remediation is complete, and it has suspended use of the LMS related to the incident.As of October 31
No further update appears on the announcement page.
Accessed: internal business systems
Learning management system (LMS) and customer relationship management (CRM). Hold contact and account information on customers and prospects
Not compromised: customer platforms
Genesys Cloud, Genesys Engage, Genesys Engage Cloud, and customer and partner data in them, including call recordings and analytics data
The company says there was no unauthorised access to the platforms or to customer and partner environments.
- Systems accessed
- Certain internal business systems, including a learning management system (LMS) and a customer relationship management (CRM) platform
- Confirmed
- Certain information in the LMS and CRM environments was accessed and/or downloaded without authorisation
- Information held in those systems
- Business and account information about existing and prospective customers, including names, business email addresses, telephone numbers, job titles, company and account information, and other information associated with customer interactions
- Not compromised (company)
- Genesys Cloud, Genesys Engage and Genesys Engage Cloud platforms; customer and partner environments; customer and partner data in the platforms, including call recordings and analytics data
- Actions taken
- Containment and immediate remediation completed; use of the LMS suspended; continued monitoring
- Still under review
- Scope and impact of the information accessed
What is known and what is not
The state as of October 31, 2026. When there is a follow-up, the status column will be updated.
| Item | What the announcement says | Status |
|---|---|---|
| Unauthorised access to and/or download of information in the LMS and CRM | Confirmed by the company | Confirmed (company) |
| Names, business email addresses, phone numbers, job titles | Held in the LMS and CRM; which items were taken for each person is not stated | Held in affected systems (company) |
| Company and account information, information on customer interactions | Same | Held in affected systems (company) |
| Genesys Cloud, Genesys Engage, Genesys Engage Cloud | Not compromised | Not included (company) |
| Customer and partner data in the platforms (call recordings, analytics data) | Unaffected | Not included (company) |
| Passwords, payment data | Not mentioned | Not stated |
| Date the company became aware | October 16, 2026 | Confirmed (company) |
| Containment | Fully contained (October 23) | Confirmed (company) |
| Number of people | Not stated | Under investigation |
| Intrusion route | Not stated | Under investigation |
| Individual notices | Not stated | Not stated |
| Publication or misuse of the data | Not mentioned | Not stated |
How to read this: 'not stated' does not mean 'did not happen'
The announcement lists what the affected systems hold, not exactly what was taken for each person. Until the company says more, assume your business contact details may be among the information accessed.
What business contact details can lead to
In general, combinations like these can be misused as follows. This does not mean it has happened here.
- Name + business email + job title + company: an email that looks like it comes from a vendor's account team, asking you to sign in, approve an invoice or open a document
- Phone number + job title: a call posing as vendor support, asking an administrator for a password or a one-time code
- Information on customer interactions: a message that refers to a real recent conversation, which makes it more believable
For companies whose staff details sit in vendors' systems
The cause has not been disclosed. This section does not assess Genesys's response; it is a check that customer companies can do on their side, based on the published facts. The distinctive point of this incident is that the product was not affected, but the vendor's own sales and training systems, which hold information about your staff, were.
- Know which vendors hold your staff's contact details. Sales CRMs and training portals of vendors hold names, job titles and phone numbers of your administrators and buyers. Keep a list of the main vendors and the staff who are named contacts, so you can tell the right people quickly when one of them has an incident.
- Agree a verification channel with each key vendor in advance. Decide how you will confirm requests about sign-in, contracts and payment details (for example, only through the support portal or the account manager you already know). Requests outside that channel can then be treated as suspicious.
- Treat vendor-themed messages to administrators as higher risk. Platform administrators have the access that matters most. Multi-factor authentication on their accounts, and a rule that they never give codes over the phone, reduce the effect of a convincing message.
Sources (public records)
The facts in this article are based on the public information below. Intrusion routes and methods that have not been disclosed are not speculated about.
- Genesys, "Security Update: Incident Affecting Certain Genesys Internal Business Systems" (October 19, 2026, updated October 23, 2026) — genesys.com
Update history
2026-10-31: First version. Based on Genesys's security update of October 19, 2026 and its October 23 update. As of October 31, no further update appears on the page. This article will be updated when the company publishes more.
Read next
- Same type of case: ENGIE customer data breach (contact details leaked via a partner's sales tool)
- Spotting follow-on scams: What is phishing? / Multi-factor authentication guide
- Other 2026 incidents: Data breaches and cyberattacks of 2026 (Japan and worldwide)