Workday workday.com Workday data breach: what happened and what to do
In August 2025, Workday said attackers used social engineering to reach a third-party CRM platform. The company said no customer tenants or the data in them were accessed. The stolen data was mainly business contact details such as names, emails and phone numbers.
View all 13,177 breaches- Breach date
- 6 Aug 2025
- Made public
- 15 Aug 2025
- Data exposed
- Names, Email addresses, Phone numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Workday told customers in mid-August 2025 that attackers had reached a third-party customer relationship management (CRM) platform it uses. According to TechRepublic and Security Affairs, Workday posted about it on August 15, and BleepingComputer reported that the company detected the breach on August 6.
The attackers contacted employees by text or phone, posing as HR or IT, to get access or personal information. Workday has not said how many people or organizations were affected.
Sources checked: techrepublic.com, securityaffairs.com, salesforceben.com
Last verified against the official page:
What was exposed
Workday said the attackers got into some CRM information but not customer tenants or the data inside them. The stolen records were mainly general business contact details: names, email addresses and phone numbers.
What it means for you
That data is enough to make a scam message convincing. If you work with Workday, or your employer uses it, expect emails, texts or calls that claim to be from Workday, HR or IT. Workday warned customers about exactly this. The risk is phishing, not stolen payroll or HR records, based on what the company has said.
Workday said it cut off the access and added safeguards against similar attacks.
What to do if you were in it
- 1
Verify unexpected contact
If someone claiming to be Workday, HR or IT asks for a password, code or personal details, hang up or ignore it and contact the team through a number or site you already know.
- 2
Never share a one-time code
No genuine support team needs the code sent to your phone or email.
- 3
Use two-factor login
Use an authenticator app or passkey on work and personal accounts.
- 4
Report scams
Report phishing and scam texts at ReportFraud.ftc.gov and tell your IT team.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details appear.
Timeline
-
The breach happened
-
The company made it public
Frequently asked
Was my Workday account hacked?
Workday said customer tenants and the data in them were not accessed. The incident involved a third-party CRM platform.
What was exposed?
Mainly business contact details such as names, email addresses and phone numbers.
Should I change my password?
Workday hasn't reported passwords as exposed. It's still sensible to avoid reused passwords and to ignore requests for codes.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
