Workday Targeted By Hackers To Run Social Engineering Scams; “Some” Data Leaked

Workday has revealed that it was recently targeted by bad actors, where hackers might have gained access to “some” information. However, the online HR management company has revealed that there were no indications that the hackers were able to gain access to Workday's customer data. The bad actors were able to gain access to the information via a third-party customer relationship management (CRM) platform.

Workday Joins The List of Tech Companies That Were Recently Attacked by Hackers

In a recent blog post, the online HR solutions company Workday revealed that it was attacked by hackers, who were later found running a social engineering campaign against its employees. The bad actors were able to gain access to “some information” through one of its third-party CRM platforms. However, the company has not revealed whether Workday or the CRM platform is working to resolve the vulnerability that was exploited by the hackers.

During the cyberattack, the hackers were primarily able to access publicly available business contact information, such as names, email addresses, and phone numbers, the company said. Workday assured its customers that neither the tenants nor the data present within them were compromised during the cyberattack. The HR management firm added that it “acted quickly” to sever unauthorised access, and has added “extra” safeguards to protect against similar cyberattacks in the future.

Workday also highlighted that leaked information can be misused for targeting people with social engineering scams. In this scam, a bad actor contacts an employee via a text message or phone call, while pretending to be from the human resources or the IT department. They aim to trick the employees into divulging sensitive information, giving them access to their accounts and other personal information.

As cyberattacks become increasingly sophisticated, hackers have been able to gain access to more sensitive corporate information. Recently, their primary targets have been tech giants. In June, a group of hackers called ShinyHunters attacked one of Google's Salesforce systems to steal data and extort bitcoins from affected employees. On August 5, the tech giant began analysing the impact of the attack and mitigating further intrusions.