Your go-to hub for Expert Insights,
Publications, and Resources on
data privacy and compliance

In a masterclass of stealth, cybercriminals quietly slipped past defenses to access personal contact details stored in a third-party database linked to Workday—one of the world’s leading providers of HR technology to over 11,000 companies and 70 million users.

Behind the Breach: A Deceptive Whisper

On August 6, alarm bells rang when Bleeping Computer flagged suspicious activity. Workday confirmed the breach in a blog post nearly a week later, noting that the attackers accessed "commonly available business contact information, like names, email addresses, and phone numbers" stored in a third-party customer relationship-management (CRM) platform. Critically, the company reassured users that there was “no indication of access to customer tenants or the data within them”—where the core human-resources files reside.

The Human Element: Social Engineering at Play

Experts believe the breach was a product of a cunning social engineering campaign: threat actors impersonated HR or IT staff to deceive Workday employees into granting access. The goal? Harvest contact details to aid further manipulative attacks.

Workday promptly cut off the breach and rolled out additional security measures. A spokesperson emphasized, “All official communications from Workday come through our trusted support channels,” warning that the company will never ask for sensitive information via phone.

Linking the Dots: A Growing Pattern of CRM Breaches

This incident is just the latest in a surge of CRM-related hacks affecting global giants. TechCrunch notes similar breaches at Google, Cisco, Qantas, and Pandora, all tied to Salesforce-hosted systems. Cybersecurity investigators and outlets like Dark Reading suggest a likely connection to the hacker collective Shiny Hunters, notorious for exploiting Salesforce platforms through “vishing” (voice phishing) to trick employees into installing malicious tools.

Why It Matters—And What Comes Next

This breach might seem modest—after all, names, emails, and phone numbers are considered low-risk. But in the hands of skilled manipulators, they become a potent tool for phishing and impersonation. Workday’s proactive response helped limit damage, yet the broader warning is clear: every CRM connection is a potential entry point.

Security veterans urge organizations to tighten third-party integrations, adopt zero-trust frameworks, enforce privileged access controls, and conduct regular audits of connected apps.

Closing Thoughts

Workday’s experience is a cautionary tale of how even trusted systems can fall prey to cunning human deception. If names and numbers are the breadcrumbs, then social engineering is the trap. The digital age demands vigilance—not just in code, but in conversation.

Stay with us for updates on: DPDP Consultants Newsletter