What to Do After the Workday Data Breach (2026)

Workday disclosed a 2026 data breach where attackers accessed a third-party customer-relationship database in its Salesforce environment, exposing names, business email addresses, and phone numbers along with support-case metadata. Critically, Workday's HR, payroll, and employee-record tenants were not impacted — the breach was limited to business contact information used for support and marketing. If you are a Workday admin or business contact, the biggest risk is now vishing and phishing built on your real contact info: move 2FA off SMS, verify any inbound "Workday support" call, and remove your personal data from broker sites so attackers cannot combine it with the leak.

What Happened in the Workday Data Breach?

Workday confirmed the incident after detecting unauthorized access to a third-party customer relationship management (CRM) database housed in its Salesforce environment. The breach is part of the wider Salesforce social engineering campaign of 2025-2026 that has hit dozens of enterprises, including Farmers Insurance, Allianz Life, and others.

Workday's third-party forensic investigation found:

• The threat actor's access was limited to a very small subset of information stored within Workday's Salesforce environment
• No customer tenants were impacted — HR, payroll, financial, and employee records remained untouched
• The threat actor did not access sensitive external files, contracts, order forms, or attachments customers may have included in support cases

What Data Was Exposed?

Per Workday's disclosure, the exposed data is limited to:

• Business contact information: Names, business email addresses, phone numbers of Workday business contacts and admins
• Basic support case details: Case subject lines and metadata (not attachments)
• Tenant-related attributes: Tenant names, data center names
• Product and service names
• Training course records
• Event logs

Not exposed:

• Employee HR data (names, SSNs, salaries, benefits) inside customer Workday tenants
• Payroll data
• Passwords or authentication credentials
• Contract documents or support-case attachments

Are You Affected?

Assume affected if:

• You are a Workday customer administrator or business contact whose email/phone were shared with Workday support
• Your organization ever opened a Workday support case with contact info on file
• You receive a direct notification from Workday

Individual employees whose data lives inside a Workday tenant (payroll records, benefits, PII) are not affected by this incident — Workday tenants were not accessed. If your only relationship with Workday is that your employer uses it for HR, you do not need to take special action.

Immediate Steps to Take (Workday Admins & Business Contacts)

Step 1: Assume Targeted Phishing Is Coming

The most likely follow-on attack is exactly what got Workday: a vishing or phishing message referencing your real Workday tenant, your real product mix, and your real support history. Expect calls and emails within the next 30-90 days that claim to be from Workday support, from a Salesforce security team, or from a "Workday security notice" that asks you to log in.

Rules for you and your team:

• No legitimate Workday support call will ever ask you to approve an MFA prompt while on the phone
• Any inbound call from "Workday" gets hung up and called back through your official Workday account manager, never the number they gave
• Any "security notice" email link goes ignored — open a browser and type the Workday URL manually

Step 2: Rotate 2FA off SMS on Every Sensitive Account

Because your phone number leaked, SIM-swap risk is elevated. Move 2FA from SMS to an authenticator app or hardware security key on your Workday admin login, corporate SSO, email, and any admin console you touch. Call your mobile carrier and add a port-out PIN.

Step 3: Rotate Workday API Keys and Long-Lived Tokens

Workday says no credentials were exposed, but as a matter of good hygiene after any incident of this shape:

• Rotate any long-lived Workday API keys or integration credentials
• Rotate SSO signing certificates if any are due
• Review admin audit logs in Workday and your IdP for unfamiliar activity since the incident window

Step 4: Warn Your Team

Anyone at your org who is a named Workday contact should know: expect impersonation attempts. A quick internal note stops most of the damage before it starts.

Step 5: Freeze Personal Credit (Prophylactic)

Business email + phone + name is not enough for direct credit fraud, but a free credit freeze at all three bureaus is cheap belt-and-suspenders in case your data gets combined with a future leak. Free and reversible at Equifax, Experian, and TransUnion.

Cut the Trail: Remove Your Data From Broker Sites

The Workday leak gives attackers your business contact info. It becomes far more dangerous when paired with data-broker records — your home address, relatives, phone numbers, and personal email — which they can buy for pennies on Spokeo, BeenVerified, Whitepages, and 100+ similar sites. Combining business and personal exposure lets a vishing caller demonstrate they "know you," which makes their pretext far more believable.

Removing your data from those brokers breaks the chain: when an attacker looks you up after the Workday leak and finds nothing on the public web tying your work identity to your personal life, most give up and move to easier targets.

Longer-Term Protection

• Use email aliases for new SaaS signups (iCloud Hide My Email, Firefox Relay, DuckDuckGo Email Protection) so one leak doesn't burn your primary inbox
• Add dark-web monitoring for both your work and personal email so you know when they appear in new dumps
• Enable phishing-resistant MFA (hardware keys) on every admin account you own
• Set fraud alerts at all three credit bureaus as a low-effort supplement to a freeze
• Report suspected identity theft at IdentityTheft.gov if you see account takeovers
• Train your SOC or IT team to expect vishing calls referencing real Workday tenant details for the next 6-12 months

Frequently Asked Questions

Is the Workday 2026 data breach confirmed?

Yes. Workday publicly confirmed unauthorized access to a third-party customer relationship database housed in its Salesforce environment. Exposed data is limited to business contact information (names, business emails, phone numbers) plus support-case metadata, tenant attributes, product names, training records, and event logs.

Was HR or payroll data leaked in the Workday breach?

No. Workday and its third-party forensic firm confirmed that no customer Workday tenants were accessed. HR, payroll, financial, and employee records inside customer tenants remained untouched. Contracts, order forms, and support-case attachments were also not accessed.

How many people were affected by the Workday breach?

Workday has not published a specific number and describes the incident as affecting "a very small subset of information" in its Salesforce environment. Affected individuals are limited to Workday business contacts and administrators whose contact details were stored in the CRM database — not the employees whose payroll data lives in Workday customer tenants.

Am I at risk if my employer uses Workday for HR?

No — not from this incident. Workday customer tenants were not accessed, so your HR file, salary, tax withholdings, benefits, and SSN inside your employer's Workday were not exposed. This breach only affects the business contact info of Workday admins and support contacts.

What is the biggest risk from the Workday leak?

Targeted vishing (voice-phishing) and phishing against Workday admins, referencing real tenant names, real product names, and real support history — the same social engineering playbook that hit Workday itself. Move 2FA off SMS, harden your MFA on admin accounts, and treat any inbound "Workday support" call with extreme skepticism.

Is there a service that can shrink my exposure after a breach like this?

Yes — PrivacyOn is our top pick. It removes your personal information from 100+ data broker sites so attackers cannot cross-reference the Workday leak with your home address, relatives, and personal email, adds 24/7 dark web monitoring, and covers up to 5 family members from $8.33/month. When a Workday admin's business identity is already exposed, hiding the personal side of your footprint is what stops most opportunistic attackers from making their pretext believable.

Should I rotate my Workday admin password after the breach?

Workday says no credentials were exposed, but rotating your admin password and any long-lived integration tokens is cheap insurance — and this is a good excuse to move any remaining SMS 2FA to an authenticator app or hardware key while you're in the settings.

Can I sue Workday over the 2026 breach?

Because the exposed data is limited to business contact info and no HR/payroll data was leaked, class-action exposure is likely narrower than for consumer-scale breaches. Plaintiffs' firms may still investigate, particularly for enterprise contacts who received notifications. Save any correspondence — consult an attorney for your situation.