Payroll, RealEstate & Finance · Payroll/HR · Data breach
Workday
Headline
Workday's 2025 breach came through the ShinyHunters social-engineering campaign - employees were phoned by people posing as IT or HR staff and talked into authorising access, with no exploit involved.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Workday's 2025 breach came through the ShinyHunters social-engineering campaign - employees were phoned by people posing as IT or HR staff and talked into authorising access, with no exploit involved. The irony is exact: the company whose product IS the HR system was breached by someone pretending to work in HR. Workday holds hiring records, compensation, performance reviews and terminations for millions of employees who, as with ADP, are not its customers and never agreed to anything. Cross-ref the Salesforce master entry in F500 Tech & Semiconductors.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected for Workday's own Terms; this is a B2B/enterprise HR platform, so most individual consumers interact with it only as job applicants or as employees of companies using Workday for payroll, not as direct retail customers.
Data sharing
TWO SEPARATE, SERIOUS FINDINGS: (1) A CONFIRMED 2025 BREACH: Workday disclosed (Aug 2025) that threat actors accessed data via a SOCIAL ENGINEERING campaign — part of the SAME broader Salesforce-linked attack wave (ShinyHunters group) that also hit Air France/KLM (see Global Airlines tab) and dozens of other companies. A resulting class action (Elias et al. v. Workday, Inc. et al., No. 3:26-cv-00725, N.D. Cal., also naming Salesforce) alleges the breach compromised personal information of MILLIONS of consumers and was 'highly preventable,' involving vulnerabilities the defendants allegedly knew about in advance; this is directly relevant since Workday is the SAME payroll/HR platform whose employee accounts were separately compromised in the Chipotle breach documented in the Consumer Apps tab — meaning Workday itself has now appeared in this tracker as both a directly-sued defendant AND the platform underlying at least one other company's separate breach. (2) A SEPARATE, EARLIER LAWSUIT (Mobley v. Workday, N.D. Cal.; on May 16, 2025 Judge Rita Lin preliminarily certified a nationwide opt-in collective action under the federal Age Discrimination in Employment Act, not a Rule 23 class action) alleges Workday's AI/algorithmic APPLICANT-SCREENING system disproportionately DISQUALIFIES JOB APPLICANTS OVER AGE 40 — an algorithmic age-discrimination claim distinct from the data-breach matter, and one of the only ALGORITHMIC BIAS findings (as opposed to a data-privacy or security finding) anywhere in this entire 300+ company tracker.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (WDAY). Service route: c/o General Counsel / Corporate Secretary, Pleasanton, California — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy workday.com/en-us/legal/privacy.html | Not fetched yet | NO (HTML only) |
| Terms of service workday.com/en-us/legal/terms-of-use.html | Not fetched yet | NO (HTML only) |
| Website workday.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: California. Provisions of CCPA/CPRA on file:
| Provision | Type | Source |
|---|---|---|
| Right to Deletion Cal. Civ. Code § 1798.105 | hard | source |
| Right to Correction Cal. Civ. Code § 1798.106 | hard | source |
| Right to Know / Access Cal. Civ. Code § 1798.110 | hard | source |
| Right to Limit Use of Sensitive Personal Information Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027 | hard | source |
| Right to Data Portability Cal. Civ. Code § 1798.130(a)(3)(B)(iii) | hard | source |
| Privacy Policy / Privacy Notice Requirements Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011 | hard | source |
| Sensitive Personal Information — Categories Cal. Civ. Code § 1798.140(ae) | hard | source |
| Service Provider and Contractor Contract Requirements Cal. Civ. Code § 1798.140(ag); Cal. Code Regs. tit. 11, § 7051 | hard | source |
| Applicability Threshold (2025 CPI-Adjusted) Cal. Civ. Code § 1798.140(d) | threshold | source |
| Privacy Risk Assessment — Mandatory for High-Risk Processing (Eff. Jan. 1, 2026) Cal. Civ. Code § 1798.185(a)(15); Cal. Code Regs. tit. 11, §§ 7150-7157 | hard | source |
| Right to Opt Out of Sale or Sharing Cal. Civ. Code §§ 1798.120, 1798.135 | hard | source |
| Sale vs. Sharing Distinction Cal. Civ. Code §§ 1798.140(ad), 1798.140(ah) | hard | source |
| Enforcement — CPPA and AG; Civil Penalties (2025 CPI-Adjusted) Cal. Civ. Code §§ 1798.155, 1798.199.90; Cal. Bus. & Prof. Code § 17206 | hard | source |
| Notice at Collection Cal. Code Regs. tit. 11, § 7012 | hard | source |
| Cybersecurity Audit — Annual Independent Audit Requirement (Eff. Jan. 1, 2026) Cal. Code Regs. tit. 11, §§ 7120-7124 | hard | source |
| Automated Decision-Making Technology (ADMT) — Notice, Opt-Out, and Access Rights Cal. Code Regs. tit. 11, §§ 7200-7222; Cal. Civ. Code § 1798.185(a)(16) | hard | source |