Genesys, a major provider of customer experience and call center software based in Menlo Park, California, has confirmed that attackers broke into internal business systems and likely downloaded account and contact information belonging to customers and partners. The company disclosed the incident on October 19 and said on October 23 that it had fully contained it.
According to Genesys, the intrusion reached a learning management system used for employee and customer training, along with a customer relationship management environment used to track business and account details. The company said the information the attackers accessed and probably took includes names, phone numbers, business email addresses, job titles, and company and account information tied to existing and prospective customers, as well as other records of customer interactions.
Genesys was careful to draw a line between these internal systems and the platforms its customers actually use day to day. “We have confirmed that the Genesys Cloud, Genesys Engage and Genesys Engage Cloud platforms were not compromised,” the company said, adding that customer and partner data stored on those production platforms was not affected. As part of its response, Genesys suspended the learning management platform and put additional containment measures in place while it investigates.
The company has not publicly named who was behind the attack, and said its investigation into the full scope and impact is continuing, with more details expected later. A group calling itself ScarlettGroup, which has surfaced only recently on the ransomware and extortion scene and has claimed other victims including Yale University Press, has claimed responsibility for the Genesys breach on its dark web leak site. That claim has not been independently verified by Genesys or confirmed in the company’s own statements.
Genesys also warned customers and partners to be alert for phishing attempts that might try to take advantage of the breach, stressing that the company will never ask for passwords by email or through other unsolicited messages. Organizations that work with Genesys, particularly those whose staff may appear in the exposed training or account records, should treat unexpected emails or calls referencing the incident with caution and verify any request through official channels before responding.
No CVE has been assigned in connection with this incident, and no technical details about how the attackers first gained access have been made public as of this writing.
Source: SecurityWeek, “Genesys Hack Exposes Customer Data From Internal Systems” by Ionut Arghire, published October 26, 2026.
