Incident BriefingsWorkday security incident

Workday security incident

Voice phishing induced personnel to authorize a malicious connected OAuth application in Salesforce. Business contact data exposed.

Last modified

Summary

  • Environment: HR/Tech
  • Operational impact: Business contact data exposed
  • Financial impact: No financial figure is established by the reviewed source evidence
  • Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.

What happened

In 2025, Workday experienced an incident in its hr/tech environment. The retained source describes the attack path as follows: Voice phishing induced personnel to authorize a malicious connected OAuth application in Salesforce. [1]

The documented consequence was: Business contact data exposed. [1]

Impact

  • Documented impact: Business contact data exposed. [1]
  • No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.

Timeline

  1. Documented public update

    The Workday’s response to the Salesloft Drift security incident records the incident facts used in this briefing.

    [1]

  2. Briefing updated

    This briefing was last reviewed and updated on September 19, 2026.

Threat Group & Attack Vector

The retained source describes the attack path as follows: Voice phishing induced personnel to authorize a malicious connected OAuth application in Salesforce. The canonical record does not add intrusion steps beyond those supported by the source. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

Response

The reviewed source does not describe containment, notification, or restoration steps in enough detail to summarize them responsibly.

This account is bounded to Workday’s response to the Salesloft Drift security incident. Details absent from that evidence are left unresolved rather than inferred. [1]