Workday Data Breach Exposed Customer Data and Case Details

Workday has disclosed a third-party security breach that exposed customer data via a compromised third‑party application. On 23 August 2025, Workday detected a critical vulnerability in Salesloft’s Drift application, which is integrated with Salesforce systems, and immediately disconnected the affected tool while invalidating associated tokens.

According to Salesloft, attackers gained OAuth credentials from their systems and used them to conduct unauthorised searches within customer Salesforce environments; Salesloft confirmed these findings on 26 August 2025 through an official statement on their trust website.

Workday’s investigation, conducted with an external forensic firm, found that a limited subset of data from its Salesforce environment was accessed, including business contact details, basic support case information, tenant attributes such as names and data centre locations, product and service information, training course records, certificates and system event logs.

The investigation noted that external files stored in Salesforce, including contracts and order forms, remained secure and were not accessible to attackers, and that customer tenants were not reached via the Drift connection. Workday urged customers to rotate credentials used in support cases and outlined security best practices to reduce risk.