Genesys says cyberattack exposed customer data from internal systems

Genesys says it has contained a cyberattack in which unauthorised access to internal business systems occurred, affecting learning management and customer relationship management environments, but not the Genesys Cloud, Genesys Engage or Genesys Engage Cloud platforms. The incident, announced on 19 October, saw attackers access and potentially download information used to manage relationships with existing and prospective customers.

The potentially compromised data includes names, phone numbers, business email addresses, job titles, company and account information, and other customer interaction details. Genesys states there was no unauthorised access to the platforms or to data stored or processed within those platforms.

Containment measures were implemented promptly, including suspending the LMS platform, and on 23 October the company said the incident had been fully contained. Genesys emphasised that investigations into the scope and impact are ongoing and said it would provide further details as material facts are confirmed.

The firm cautioned customers to expect suspicious communications that impersonate Genesys, reiterating that it would never request sensitive information such as passwords via email or other unsolicited channels. The attacker has not been named by Genesys, though a group calling itself ScarlettGroup has claimed the attack on its leak site. The article notes that the affected data concerns internal systems and does not implicate the customer data stored in the main platforms.