What happened

Workday, one of the world's largest providers of human resources and finance software, disclosed on August 15, 2025 that it had suffered a data breach after attackers used social engineering to gain access to a third-party customer relationship management (CRM) platform the company uses internally. In a public blog post, Workday said it had "recently identified a social engineering campaign targeting many large organizations," and that its own employees had been targeted through phone calls and text messages from attackers posing as HR or IT staff.

According to Workday's disclosure and subsequent reporting, the initial intrusion traces to on or around August 6, 2025, when the attackers used voice phishing, commonly called "vishing," to convince an employee to hand over account access or divulge information that allowed the threat actor into a Salesforce-based CRM environment. Once inside, the attackers were able to access and export data stored in that system.

Scope of the breach

Workday was emphatic that the intrusion did not touch its core HR or payroll platform. The company said there was no indication that customer tenants — the isolated environments where Workday customers store their own HR and financial data — were accessed, and that no Social Security numbers, payroll records, or other sensitive HR data belonging to Workday's enterprise customers were compromised.

Instead, the data exposed was largely limited to business contact information: names, email addresses, and phone numbers, along with some basic support-case details tied to Workday's own customer service records. While that may sound comparatively minor next to a payroll-data leak, security researchers warned that this kind of contact information is exactly what attackers need to run further, more convincing social engineering attacks — including against Workday's own customers, who could now be targeted with phishing or vishing calls that reference real support tickets or account details.

The attackers and the wider campaign

Workday's breach was one of dozens tied to a coordinated campaign that cybersecurity researchers attribute to a group tracked as UNC6040, which has close and likely overlapping ties to the ShinyHunters extortion collective and, by extension, to the loosely affiliated Scattered Spider network. Throughout mid-2025, this campaign systematically targeted employees at large organizations that used Salesforce as their customer relationship management platform, relying almost entirely on voice phishing and impersonation rather than software exploits.

The same wave of vishing attacks hit a long list of major brands, including Google, Cisco, Adidas, Qantas, Allianz Life, Chanel, Louis Vuitton, Dior, and Tiffany & Co. In several of these cases, attackers impersonated internal IT support staff on phone calls, convincing employees to either read out multi-factor authentication codes or approve a malicious connected application inside Salesforce, granting the attacker read and export access to CRM records.

Separately, in the days after Workday's initial disclosure, a related but distinct incident also touched the company: the compromise of OAuth tokens tied to Salesloft's Drift chatbot integration, an intrusion tracked as UNC6395, which affected several hundred organizations that had connected Drift to their Salesforce environments between roughly August 9 and August 17, 2025. Workday confirmed it was among the organizations affected by that token-theft incident as well, though it again described the exposed data as a limited subset of business contact and support-case information, not core platform data.

Response and remediation

Workday said it moved quickly to contain the incident once it was discovered, revoking the attacker's access to the compromised CRM instance and beginning an investigation with outside forensic help. The company notified affected individuals and worked with law enforcement, and it published guidance urging employees and customers to be wary of unsolicited calls or texts claiming to be from IT or HR asking for credentials, one-time passcodes, or approval of new connected applications.

More broadly, Workday used the incident to reinforce its existing advice to customers: enable phishing-resistant multi-factor authentication wherever possible, restrict and regularly audit third-party OAuth application permissions connected to CRM and other cloud platforms, and train staff to independently verify any request for account access or credentials rather than trusting inbound caller ID or caller claims. Workday said it did not believe any customer HR or financial data hosted on its core platform was affected, and encouraged customers to remain vigilant against follow-on phishing attempts referencing the leaked contact information.

The Workday incident became one of the most closely watched entries in what researchers dubbed the "2025 Salesforce breach wave," a campaign notable less for technical sophistication than for how effectively it exploited human trust in corporate help-desk processes across dozens of major companies simultaneously.

Two related but distinct incidents

Security teams tracking the campaign took care to distinguish between the two waves that touched Workday within weeks of each other. The first, disclosed August 15, involved direct vishing against a Workday employee to gain access to Workday's own Salesforce CRM instance — the incident attributed to UNC6040 and ShinyHunters. The second, which Workday acknowledged shortly after on its blog under the heading "Workday's Response to the Salesloft Drift Security Incident," stemmed from a completely different intrusion path: attackers tracked as UNC6395 stole OAuth authentication tokens from Salesloft's Drift chatbot integration itself, rather than tricking any Workday employee, and used those tokens to query Salesforce instances at every organization that had connected Drift, Workday among them.

That distinction mattered for how customers were advised to respond. The vishing-driven breach was a reminder to train staff against impersonation calls; the Drift token theft was a reminder to audit and limit the permissions granted to any third-party application connected to a core business system, since a single compromised integration point ended up exposing data at more than 700 organizations simultaneously, including large technology and security vendors like Cloudflare, Google, Palo Alto Networks, Proofpoint, and Zscaler.

Industry reaction

The back-to-back disclosures prompted renewed scrutiny of Salesforce's ecosystem of connected third-party applications, with several security vendors publishing guidance on auditing OAuth grants and rotating API tokens for any Salesforce-linked integration. Salesloft took its Drift product offline temporarily while it investigated the token theft, and Salesforce itself pushed guidance to customers about reviewing connected-app permissions. For Workday specifically, the episode became a widely cited case study in how even companies with mature internal security programs remain exposed through the CRM and support tooling their own employees rely on daily.