Workday data breach (2025): a social-engineering attack on a third-party CRM
Workday holds HR and payroll data for many large employers, so “Workday data breach” is a frightening search. The 2025 incident was narrower: attackers talked employees into giving access to a third-party CRM and took business contact details. This page records what Workday said, what it did not, and why the wider campaign still matters to Workday customers.
Short answer
Was Workday hacked?
Yes, but not the HR platform customers use. On 15 August 2025 Workday said attackers had used social engineering, contacting employees by phone or text while posing as HR or IT, to access some information in a third-party CRM platform. A customer notice put discovery at 6 August.
Workday said the data was mostly commonly available business contact information such as names, email addresses and phone numbers, and that there was “no indication of access to customer tenants or the data within them.” It warned the contact data could be used in follow-on scams and reminded customers it never asks for passwords by phone. Reporting places the incident in the 2025 Salesforce-targeting wave linked to ShinyHunters; Workday has not named the CRM or the attacker.
Timeline at a glance
6 Aug 2025Workday discovers access to a third-party CRM (per a customer notice). (BleepingComputer)Reported
15 Aug 2025Workday blog: social engineering, business contact data, no access to customer tenants. (Workday)Confirmed
Aug 2025Linked in reporting to the Salesforce-targeting vishing wave. (BleepingComputer)Reported
12 Sep 2025FBI FLASH describes the vishing technique used across that wave. (FBI)Confirmed
Last updated October 30, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Workday incident timeline, in detail
Confirmed = acknowledged by Workday, a regulator filing or a court. Reported = credible reporting Workday has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Aug 2025ConfirmedSocial engineering / SaaS
Social-engineering attack on a third-party CRM; business contact data taken
What happened. Workday said a social-engineering campaign targeting many large organisations, including Workday, gave attackers access to some information from a third-party CRM platform. Attackers contacted employees by text or phone, pretending to be from HR or IT, to obtain access. Workday said it cut the access and added safeguards.
Impact. Mostly business contact information (names, email addresses, phone numbers). “There is no indication of access to customer tenants or the data within them,” per Workday. It did not say how many people or companies were in the data.
Part of the ShinyHunters / Salesforce wave, per reporting
What happened. BleepingComputer and TechCrunch placed Workday among companies whose Salesforce-hosted data was stolen in 2025 in a campaign linked to ShinyHunters; the FBI’s September FLASH describes the voice-phishing method. Workday has not named the CRM or confirmed the attacker.
Workday calls it a third-party CRM; reporting says Salesforce. Workday has not confirmed the platform.
Scale: Workday has not said how many records or contacts were taken.
The pattern across the record
Low-value data, high-value follow-up
Business contact data is not sensitive on its own, but it tells a scammer who your HR and payroll administrators are, which is exactly who a Workday-themed phishing call would target.
What it means for Workday customers — and what to do
Workday says customer tenants were not touched. The practical risk for customers is impersonation: calls and emails that use real names and contact details to ask for credentials or changes.
1.Warn HR, payroll and Workday admins
Workday will not ask for passwords or MFA codes by phone. Route any such request to a callback on a known number.
2.Harden admin sign-in
Use phishing-resistant MFA for Workday administrators and SSO admins.
Workday disclosed in August 2025 that attackers used social engineering to access a third-party CRM and took mostly business contact information. It said there was no indication of access to customer tenants or the data in them.
Was Workday customer HR or payroll data exposed?+
Workday says no: “There is no indication of access to customer tenants or the data within them.” The stolen data was mostly names, email addresses and phone numbers in a CRM.
Was the Workday breach part of the Salesforce hacks?+
Reporting links it to the 2025 Salesforce-targeting wave associated with ShinyHunters. Workday has not confirmed the platform or the attacker.
What should Workday customers do?+
Brief HR, payroll and admin staff that Workday will not ask for credentials by phone, use phishing-resistant MFA for admins, and verify any bank-detail change out of band.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Workday. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout