Charles Esther
Popular HR platform Workday has confirmed it was targeted in a recent data breach linked to a broader social engineering campaign.
The company revealed in a statement that hackers impersonated HR or IT staff to deceive employees into sharing sensitive information.
Scope of the Attack
According to Workday, the attackers’ main objective was to gain account access or steal personal details from unsuspecting staff members.
The firm stressed that so far there is no evidence customer tenants or internal data systems were compromised.
Type of Information Accessed
The statement clarified that the stolen data mostly included commonly available business contact details such as names, phone numbers, and email addresses.
Workday explained that this information may have been gathered to fuel further phishing schemes against other organizations.
Broader Campaign Targets Major Firms
The breach appears to be part of a wider series of phishing and social engineering attacks also targeting Salesforce CRM instances.
Global companies like Google, Adidas, and Dior have reportedly fallen victim to similar tactics, showing the growing scale of the threat.
How Hackers Exploit Salesforce Weakness
Security experts believe the attackers may have linked malicious OAuth apps to company Salesforce accounts.
This method allows them to download sensitive databases, later used for extortion or resale.
Expert Warnings on Rising Threats
Kevin Marriott, Head of SecOps at Immersive, told TechRadar Pro that these breaches are “easier to perform yet highly effective,” making them attractive to cybercriminals.
He noted that CRM systems are prime targets because they store valuable customer information.
The Role of ShinyHunters Group
Investigators suggest the notorious hacker group ShinyHunters could be behind the latest wave of attacks.
The group has previously been linked to targeting SaaS platforms containing valuable data across industries.
Preventive Safeguards Introduced
Workday confirmed it has implemented new security measures to reduce the risk of future incidents.
The company is also urging employees and customers to remain alert against phishing threats.
Phishing Remains a Major Risk
Cybersecurity experts warn that phishing remains one of the biggest red flags for potential data breaches.
Users are advised to remain skeptical of unsolicited emails or text messages, particularly those demanding urgent action.
Advice for Users
Workday recommends individuals adopt stronger digital hygiene practices, including verifying the identity of anyone requesting sensitive information.
Security analysts emphasize that staying vigilant is the best way to protect against evolving phishing threats
