19th August 2025 Cyber Update: HR Giant Workday Hit by Social Engineering Attack Exposing 70+ Million Users

Update: Workday disclosed on Friday, August 15, 2025, that threat actors infiltrated its third-party customer relationship management platform through a sophisticated social engineering campaign. The breach, discovered on August 6, exposed business contact information including names, email addresses, and phone numbers stored in the CRM system.

The company stated, “We want to let you know about a recent social engineering campaign targeting many large organizations, including Workday. We recently identified that Workday had been targeted and threat actors were able to access some information from our third-party CRM platform. There is no indication of access to customer tenants or the data within them.”

The incident has been linked to the ShinyHunters extortion group, which has been targeting Salesforce CRM instances through voice phishing and OAuth manipulation. Attackers typically impersonate IT or HR personnel, convincing employees to authorize malicious applications that grant persistent database access. Once inside, they exfiltrate company data for extortion purposes.

Workday terminated the unauthorized access, introduced additional safeguards, and reminded customers that it never requests passwords or secure details via phone.

Why it Matters: This breach highlights how third-party platforms can become entry points for attackers, with one compromised CRM exposing data across multiple organizations. For Australian businesses, the incident is a reminder that global supply chain breaches can quickly ripple into local operations. The ShinyHunters campaign also illustrates the growing sophistication of social engineering, where human deception is now as dangerous as technical exploits.