Genesys, the contact-centre and customer-experience software company, says an unauthorized third party got into some of its internal business systems, including a learning management system (LMS) and a customer relationship management (CRM) platform. In a security update dated 19 October 2026, Genesys said it became aware of the incident on 16 October and that certain information in the LMS and CRM was "accessed and/or downloaded without authorization". The systems held business and account information about existing and prospective customers, such as names, business email addresses, phone numbers and job titles.
Genesys says its customer platforms were not affected. Genesys Cloud, Genesys Engage and Genesys Engage Cloud were not compromised, and there was no unauthorized access to customer and partner environments or to the data stored or processed in them, including call recordings and analytics data. In an update on 23 October, Genesys said it had fully contained the intrusion, finished its immediate remediation and suspended use of the affected LMS. Its review of what was accessed is still under way.
For most Genesys customers, the practical risk is phishing or impersonation that uses business contact details to pose as Genesys, not a compromise of their contact centre. Genesys says it will never ask customers for passwords or other sensitive information by email or other unsolicited channels. No CVE is involved, so there is nothing to look up in CISA's Known Exploited Vulnerabilities catalog.
Technical Information
What Genesys has said
From Genesys' security update (19 October 2026, updated 23 October 2026):
- Systems accessed. The unauthorized third party "was able to access certain internal business systems, including a learning management system (LMS) and a customer relationship management (CRM) platform." The word "including" means Genesys has not ruled other internal systems in or out; it has named only these two.
- Data. Genesys confirmed that "certain information in our LMS and CRM environments was accessed and/or downloaded without authorization." It says these systems hold "business and account information used to manage relationships with existing and prospective customers, including names, business email addresses, telephone numbers, job titles, company and account information, and other information associated with customer interactions." Genesys has not said which of these fields were taken, or how many customers or people are involved.
- Customer platforms. Genesys Cloud, Genesys Engage and Genesys Engage Cloud "were not compromised". There was "no unauthorized access" to those platforms, to customer and partner environments, or to customer and partner data stored or processed in them. That data, "including call recordings and analytics data", remains unaffected.
- Containment. On 19 October Genesys said it believed the activity was contained, with no evidence of continued unauthorized access. On 23 October it said it had "fully contained the intrusion and incident", completed its immediate remediation, continues to monitor its environment, and has suspended use of the LMS involved.
- Still open. Genesys is reviewing the information accessed to determine scope and impact, and says it will provide more updates "as material facts are confirmed".
Genesys has not described how the third party got in, and has not named an attacker.
Claimed responsibility (unverified)
SecurityWeek reported on 26 October that a recently emerged group called ScarlettGroup has claimed the attack on its leak site. This is the group's claim only. Genesys has not named the attacker or confirmed the claim, and Rescana has not viewed the listing or any data. We do not repeat the group's statements about what it holds.
Timeline
| Date | Event | Source |
|---|---|---|
| 16 Oct 2026 | Genesys becomes aware of the incident and starts an investigation | Genesys |
| 19 Oct 2026 | Genesys publishes its security update: internal systems including the LMS and CRM accessed; Genesys Cloud, Engage and Engage Cloud not compromised | Genesys |
| 23 Oct 2026 | Genesys update: intrusion fully contained, immediate remediation completed, LMS use suspended, review continuing | Genesys |
| 26 Oct 2026 | SecurityWeek reports the incident and notes ScarlettGroup's leak-site claim | SecurityWeek |
| 27 Oct 2026 | Genesys page still shows 23 October as the latest update; no national CERT notice naming Genesys found | Rescana check |
What is not known
- What exactly was taken, and from how many organisations. Genesys lists what the systems hold, not what was downloaded or how many records.
- How access was gained. No entry point, vulnerability or compromised account has been disclosed.
- Whether other internal systems were involved. Genesys says "certain internal business systems, including" the LMS and CRM, and has not said whether any others were accessed.
- Whether the ScarlettGroup claim is genuine.
Affected Product Versions
This is an incident in Genesys' own business systems, not a flaw in a Genesys product. There is no CVE, affected version or patch.
| Item | What Genesys says | Status |
|---|---|---|
| Internal LMS | Accessed; certain information accessed and/or downloaded; use suspended | Contained (Genesys, 23 Oct) |
| Internal CRM platform | Accessed; certain information accessed and/or downloaded | Contained (Genesys, 23 Oct) |
| Other internal business systems | Not named | Not stated |
| Genesys Cloud, Genesys Engage, Genesys Engage Cloud | Not compromised; no unauthorized access | Unaffected (Genesys) |
| Customer and partner environments, and data in the platforms (incl. call recordings and analytics data) | No unauthorized access; unaffected | Unaffected (Genesys) |
| Attacker identity | Not named by Genesys | ScarlettGroup claim only (SecurityWeek) |
Workaround and Mitigation
Genesys' update does not ask customers to reset credentials or change platform settings. That is Rescana's reading of the 19 and 23 October text, not a Genesys statement. What Genesys does recommend is to stay alert for suspicious communications referencing Genesys, keep following security best practices, and review the recommended security practices and resources for your Genesys platform (Genesys publishes its platform security resources in its Trust Center). The steps below are Rescana guidance for Genesys customers and prospects, built on that advice.
- Expect convincing Genesys-themed messages. Contact details and account information can make phishing look routine: a renewal notice, a support case, an invoice, a training reminder or a "security update" link. Verify any unexpected request through a contact you already know or your Genesys admin console, not through links or numbers in the message.
- Never share passwords, MFA codes or API credentials in response to an email, call or chat, however legitimate it looks. Genesys says it will never ask for them that way. Damovo, a Genesys partner and integrator, gives similar advice in its own customer notice of 26 October and applies it to messages claiming to come from Genesys, Damovo or associated partners. We cite it as an example of partner notification, not as a Genesys source.
- Brief the people most likely to be targeted: contact-centre administrators, IT and telephony teams, procurement and accounts payable. These are the roles most likely to appear in a vendor's CRM.
- Watch for payment-change requests. Treat any request to change bank details for Genesys or a Genesys partner as suspicious until confirmed by phone with a known contact.
- Check your own platform hygiene anyway. Confirm MFA or SSO is enforced for Genesys admin accounts and that unused admin users and OAuth clients are removed. This is routine good practice, not a sign that platforms were affected.
- If you used Genesys training portals, watch for messages that refer to courses, certifications or learner accounts. Genesys has not said what learner data the LMS held.
- Follow Genesys' updates. Genesys says it will share more as material facts are confirmed. Ask your Genesys account team or partner whether your organisation's records were involved; Genesys has not said whether it will notify affected customers individually.
Indicators of Compromise
No indicators of compromise have been published by Genesys, by a national CERT, or in the reporting cited here (checked 27 October 2026). Rescana does not publish material from extortion sites.
What we will update
We will update this post if Genesys publishes new findings on what was taken or how access was gained; if Genesys or a regulator confirms the number of affected organisations; if a national CERT publishes a notice; or if top-tier press verifies or refutes the ScarlettGroup claim.
Sources
- Genesys, Security Update: Incident Affecting Certain Genesys Internal Business Systems (19 October 2026, updated 23 October 2026)
- Genesys, Trust Center
- SecurityWeek, Genesys Hack Exposes Customer Data From Internal Systems (26 October 2026)
- Damovo (Genesys partner and integrator; supplementary example), Security Update Regarding Genesys (26 October 2026)
Checked, nothing found (27 October 2026): CISA, CERT-EU and UK NCSC notices naming Genesys; CISA KEV (no CVE involved).
Why this matters for third-party risk
Even when a supplier's product is untouched, its CRM and training systems hold a map of who its customers are and who to contact there, and that is exactly what makes impersonation work. A good vendor review asks how suppliers protect customer data in their own business tools, how fast they tell you when those tools are breached, and how you can verify that a message really comes from them.
Forward this to your TPRM owner: Genesys says intruders accessed its internal LMS and CRM (business contact and account data). Genesys Cloud, Engage and Engage Cloud, and call recordings, were not affected. Main risk: phishing posing as Genesys. Brief contact-centre admins, IT and finance; verify Genesys requests through known contacts (Rescana guidance).
Want to see which of your suppliers hold customer-relationship data like this, and how they handle an incident? Book a demo.
