Contact-center vendor Genesys says it learned of an intrusion on Oct 16. The attacker reached internal business systems, including a learning management system (LMS) and a customer relationship management (CRM) platform, and Genesys confirms information there was accessed and/or downloaded. That covers names, business emails, phone numbers, job titles, company and account details, and other customer interaction information.

Genesys says the Genesys Cloud, Genesys Engage and Genesys Engage Cloud platforms, customer and partner environments, and data processed in them (including call recordings and analytics) were not accessed. On Oct 23 it said the intrusion is fully contained and the LMS has been suspended. Scope review continues. SecurityWeek reports that the ScarlettGroup gang claimed the attack on its leak site. Genesys hasn't named an attacker.

For Genesys customers: expect targeted phishing that uses real account and contact details. Genesys says it will never ask for passwords by email or unsolicited channels. Warn the people listed as your Genesys contacts and admins.