INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Social Engineers Steal Business Contact Details from Workday CRM

| 2025-08-18 14:31 CRITICAL MEDIUM DATA BREACH
JSON
Executive Summary
AI-generated
A sophisticated social engineering scam targeted Workday's third-party CRM platform, resulting in the theft of primarily commonly available business contact information such as names, email addresses, and phone numbers. The attackers posed as HR or IT staff to gain access, then slipped in malicious OAuth apps to quietly drain cloud systems. Three notorious cybercrime gangs appear to be collaborating, with ShinyHunters being linked to the incident through a string of recent Salesforce-related heists. Victims include companies such as Adidas and Qantas, among others. The breach was discovered almost two weeks ago on August 6, but Workday has not disclosed how many customers were affected or what measures it took to prevent similar incidents in the future.
Technical Mitigations AI-generated
• Use OAuth apps with strict validation and verification to prevent malicious app installations. • Monitor for phishing or vishing scams using business contact information, such as names, email addresses, and phone numbers. • Implement additional security measures internally to protect employees from similar social engineering campaigns.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
gr•••••.three
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Scattered SpiderScattered Spider
Target & Sectors
Global Scope technologytechnology
Incident Timeline
‎2025/08/18
Threat actors using social engineering tactics posed as IT or HR to target Workday, successfully draining cloud systems and obtaining primarily business contact information.
threat_actor Scattered Spider
As El Reg reported, ShinyHunters, Scattered Spider, and Lapsus$ appear to be swapping tips – and perhaps targets – in a shared Telegram hangout.
Intelligence Sources
The Register - CSO 2025-08-18