HR GIANT WORKDAY DISCLOSES DATA BREACH AMID SALESFORCE ATTACKS

Summary from the TLDR InfoSec newsletter

Workday disclosed a breach on August 6 where attackers accessed business contact information (names, emails, and phone numbers) from its third-party CRM platform through social engineering, though customer tenants remain unaffected. The attack is linked to ShinyHunters' ongoing campaign targeting Salesforce instances via OAuth app social engineering, which has affected multiple major companies, including Adidas, Google, and luxury brands. Attackers pose as HR or IT staff via phone/text to trick employees into revealing credentials, then use malicious OAuth apps to exfiltrate databases for extortion purposes.