1
Published signals
currently linked to this company
Company intelligence
Workday cybersecurity incidents and threat signals
workday.com
This company page brings together public reporting currently associated with Workday. It reflects signals published by Shadow Tier and should not be read as a complete incident history.
Company links
0
Last 28 days
recent published signals
0
Last 90 days
recent published signals
0
High or critical
confidence classifications
June 26, 2026
Latest report
most recent published signal
Explore related intelligence
Explore this reporting from another angle
Based on all published signals currently linked to Workday. Affected countries come from victim data; the company country above remains a separate profile fact. Counts describe this reporting set, not overall incident prevalence.
Attack patterns
Company signals
All published signals involving Workday
Workday confirms data breach from social engineering attack on third-party CRM
Workday confirmed a data breach stemming from a social engineering attack targeting a third-party Customer Relationship Management (CRM) system. The breach, reported on August 20, 2025 (after initial disclosure on August 15), compromised business contact information including names, email addresses, and phone numbers, but did not impact customer tenants or their secure data. The attack is linked to the ShinyHunters/Scattered Spider groups.
FAQ
Questions about Workday cybersecurity reporting
What does the Workday page include?
It combines a reviewed organization profile with all current published Shadow Tier signals explicitly linked to Workday.
Does every mention of Workday appear here?
No. A signal must contain a reliable company connection and meet the publication criteria; incidental or ambiguous mentions are excluded.
Why can the incident count change?
The page follows current published reporting. Counts change as new evidence is added, classifications are reviewed, or older signals leave the reporting window.