2026-10-31
Genesys Internal Systems Breach (October 2026): Systems Holding Customer Contact Data Accessed, Platforms Not Affected, and What Customers Should Do
On October 19, 2026, Genesys, the provider of the Genesys Cloud contact-center platform, announced a cybersecurity incident involving an unauthorised third party. The company became aware of it on October 16. Its investigation found that the third party was able to access certain internal business systems, including a learning management system (LMS) and a customer relationship management (CRM) platform, and the company confirmed that certain information in those systems was accessed and/or downloaded without authorisation. Information maintained in these systems includes business and account information about existing and prospective customers, such as names, business email addresses, telephone numbers, job titles, company and account information, and other information associated with customer interactions. The company says the Genesys Cloud, Genesys Engage and Genesys Engage Cloud platforms were not compromised and that customer and partner data within them, including call recordings and analytics data, was not accessed. On October 23 it said the incident had been fully contained and that it had suspended use of the LMS. The number of people affected has not been published. This site's take: staff whose contact details a vendor holds should treat unexpected messages that mention Genesys and ask for passwords or sensitive information as fake, and confirm through a channel they already use.