Workday, a major HR and finance company, has disclosed a data breach involving a third-party customer relationship management (CRM) system, where attackers accessed business contact information such as names, phone numbers, and email addresses. The breach is part of a broader social engineering campaign targeting large organizations, where attackers pose as IT or HR representatives, contacting employees via phone or text to trick them into revealing personal information or account access. The attack has been linked to the notorious cybercrime groups Scattered Spider and ShinyHunters, known for targeting Salesforce instances, highlighted last week in CTIX FLASH Update: August 15, 2025. These groups employ social engineering tactics to persuade employees to link malicious OAuth applications s to Salesforce systems, enabling them to download and steal company databases. The stolen data is subsequently used for extortion, as seen in attacks on companies like Adidas, Allianz Life, Cisco, Dior, Louis Vuitton, Google, and Air France and KLM. Workday emphasized that customer tenants or their data were not accessed, and the company has implemented safeguards to prevent similar incidents. The Workday breach was discovered on August 6, and it highlights the growing threat of social engineering and phishing attacks targeting CRM platforms.