Alert! Workday confirms breach of third-party database, personal data at risk

Workday, a prominent player in human resources technology, has acknowledged a breach involving the unauthorized access of personal data from a third-party customer relationship database. In a blog post published on Friday, the company disclosed that cybercriminals gained access to a significant amount of information, primarily consisting of names, email addresses, and phone numbers. While Workday has not confirmed if any corporate customer data was directly impacted, it emphasized that there is no evidence suggesting access to customer tenants or the sensitive information stored within them. These tenants typically house extensive human resources records and personal details of employees. The company issued a warning regarding the potential misuse of the stolen data, highlighting that it could be leveraged in social engineering attacks, where criminals manipulate victims to obtain sensitive information. According to a report by TechCrunch, Workday serves over 11,000 corporate clients and supports at least 70 million users worldwide. The breach, detected on August 6, has not revealed the identity of the affected third-party database. This incident coincides with a growing trend of attacks targeting databases hosted on Salesforce. Recent breaches have impacted major organizations, including Google, Cisco, Qantas, and Pandora, all of which faced data theft from their cloud systems. In a related incident, Google confirmed that one of its Salesforce systems, used for storing contact details of small and medium-sized businesses, was momentarily compromised by a cybercriminal group known as UNC6040. This group employs voice phishing, or 'vishing,' to deceive employees into granting access to sensitive systems by impersonating IT support staff during phone calls. They utilized social engineering techniques to convince employees to authorize malicious software linked to their Salesforce environment, enabling them to extract basic contact details, most of which were already publicly accessible. The attack was thwarted before further damage could occur. Notably, UNC6040 is recognized for targeting Salesforce platforms, often misusing tools like the 'Data Loader' app, which facilitates bulk data handling. In many instances, hackers deploy counterfeit versions of this application under misleading names to evade detection during phishing attempts.