Workday CRM contact data taken in a social engineering campaign
Workday said in mid-August 2025 that it had been targeted in a social engineering campaign and that threat actors accessed some information from its third-party CRM platform, mainly business contact details such as names, email addresses and phone numbers. Workday said there was no indication of access to customer tenants or the data in them, and warned the data could support follow-on scams.
- Victim
- Workday
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Not disclosed
- First disclosed
- Aug 15, 2025
- Actor
- Unattributed
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
The CRM, not the core product, was the soft target. Treat CRM and support tooling as identity-critical: phishing-resistant MFA, connected-app allowlists and export alerting.
Sources
- Protecting You From Social Engineering Campaigns: An Update From Workday, Workday, Aug 15, 2025
- Workday confirms CRM breach via social engineering, The Register, Aug 18, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
- Mixpanel smishing breach exposes OpenAI API user data 2025 · Credential phishing
- Retool SMS phishing, deepfaked call and Google Authenticator cloud sync 2023 · Credential phishing
- Mailchimp internal support tool access via employee social engineering 2023 · Credential phishing
Cite this record
SWI Community Team. (2026). Workday CRM contact data taken in a social engineering campaign. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-workday-crm-social-engineering/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.