HR ciant Workday reports data breach caused by Salesforce social engineering attack
Learn More
Workday, the California-based human resources and financial management software giant, reports a data breach after hackers compromised a their (CRM) platform through a social engineering attack
The company discovered the breach on August 6, 2025, and publicly reported it on August 15. The attack is part of a broader social engineering campaign attributed to the ShinyHunters extortion group, which has been targeting Salesforce CRM instances through voice phishing and social engineering attacks since the beginning of 2025.
Threat actors contacted Workday employees via text messages and phone calls, impersonating human resources and IT personnel to trick staff into linking malicious OAuth applications to their company's Salesforce instance. Once the malicious OAuth app was authorized, the attackers used the connection to download and steal data from the companies' databases.
Exposed Data includes:
- Names
- Email addresses
- Phone numbers
The number of affected individuals is not disclosed.
This data breach is part of a coordinated campaign that has affected at least 91 organizations worldwide, including high-profile companies such as Adidas, Qantas, Allianz Life, Louis Vuitton, Dior, Tiffany & Co., Chanel, and Google.
The company cautioned customers that Workday will never contact anyone by phone to request passwords or other secure details, emphasizing that all official communications come through trusted support channels.
