Workday breach via third-party CRM tied to social engineering

Workday confirmed a data breach involving a third-party customer relationship management platform, revealing that threat actors gained access through a social engineering campaign that targeted many large organizations, including the HR software provider itself. The company said the information accessed was primarily contact details such as names, email addresses, and phone numbers, and that there was no indication of access to customer tenants or the data within them. The breach was discovered in early August, and Workday moved quickly to cut the access and strengthen safeguards to prevent a recurrence.

The incident centers on Workday’s use of a third-party CRM system, a common arrangement for organizations that manage vast networks of customers and vendors. Workday’s advisory notes that the attackers’ goal was to facilitate follow-on social engineering attempts, rather than to directly retrieve employee records or HR files stored in tenants. In its communications, the company warned that the exposed data could be leveraged to refine phishing or vishing campaigns aimed at stealing credentials or sensitive information, while stressing that official company communications would...