Genesys, a Menlo Park, California based provider of customer experience and call center technology, has confirmed a cyberattack that gave hackers unauthorized access to internal business systems. The company said the intrusion involved its learning management system (LMS) and a customer relationship management (CRM) environment, both used to support internal operations rather than customer-facing services.

According to Genesys, the attackers accessed and likely downloaded business and account information used to manage relationships with existing and prospective customers. The potentially exposed data includes names, phone numbers, business email addresses, job titles, company and account details, and other customer interaction information.

Genesys emphasized that its core platforms, Genesys Cloud, Genesys Engage, and Genesys Engage Cloud, were not compromised. The company said there was no unauthorized access to those platforms or to customer and partner data stored or processed within them.

Containment and Response

Genesys said it moved quickly to contain the incident, including suspending the affected LMS platform. On October 23, the company announced the incident had been fully contained. It confirmed again that its primary customer-facing platforms and the data within them remained untouched throughout the attack.

As of its most recent update, Genesys said its investigation into the scope and impact of the breach is ongoing. The company stated it will share additional details as it reviews the accessed information and confirms further facts.

Genesys also warned customers to be alert for phishing attempts or other suspicious communications impersonating the company. It stressed that it will never request sensitive information, such as passwords, via email or other unsolicited channels.

Attribution

Genesys has not officially named the party responsible for the attack. However, a group calling itself ScarlettGroup, which has recently emerged in the threat landscape, has claimed responsibility for the breach on its data leak site.

  • Systems affected: internal learning management system and CRM environment
  • Data potentially exposed: names, phone numbers, business emails, job titles, company and account details, customer interaction data
  • Unaffected: Genesys Cloud, Genesys Engage, Genesys Engage Cloud platforms and customer/partner data within them
  • Status: contained as of October 23; investigation ongoing