Workday Confirms Recent Data Breach

Human capital management giant Workday recently confirmed a breach into the database of one of its third-party customer relationship management (CRM) platforms. According to an August 15 release by the company, the hacker(s) only retrieved “commonly available business contact information.”

Cybersecurity news portal BleepingComputer reported that this incident appears to be part of an ongoing attack on the Salesforce CRM platform, which has also resulted in the breach of companies like Google, Cisco, Adidas, and more.

Workday is one of the largest human-resource (HR) companies in the world, offering cloud-based services to over 11,000 companies worldwide with an estimated user base of 70 million, per the company’s own website.

“We want to let you know about a recent social engineering campaign targeting many large organizations, including Workday,” reads the company’s official statement.

“We recently identified that Workday had been targeted and threat actors were able to access some information from our third-party CRM platform. There is no indication of access to customer tenants or the data within them.”

Workday said the stolen information consisted of “commonly available business contact information, like names, email addresses, and phone numbers.”

The company confirmed no financial or confidential information was exposed. However, the stolen data could be used in the future for “phishing” attacks, where hackers use social engineering to get their victims to click on malicious links or reveal sensitive information.

This wave of attacks has been linked to the ShinyHunters extortion group and is commonly believed to have started as a social engineering attack targeting Salesforce employees. After the initial breach, hackers then illegally accessed the companies’ databases, giving them data that could be used for phishing or extortion.

As reported by BleepingComputer, a private message sent to potentially affected customers reveals that Workday originally learned of the attack as early as August 6.

“It’s important to remember that Workday will never contact anyone by phone to request a password or any other secure details. All official communications from Workday come through our trusted support channels,” continues the company’s release.

Phishing and other social engineering scams have been ramping up in 2025, affecting thousands of people worldwide. In May, hackers breached the largest crypto exchange in the world to access customer data, which could be used for further phishing schemes.