Workday Breach Likely Linked to ShinyHunters Salesforce Attacks

**Executive summary:** Workday confirmed a compromise of a third-party CRM via a social-engineering campaign likely tied to the ShinyHunters extortion group, which accessed commonly available business contact information (names, emails, phone numbers) but — according to Workday — not customer tenant data; the incident is part of a wider series of attacks targeting Salesforce instances at multiple large organizations and highlights the use of impersonation, phishing/vishing, and vendor supply-chain pivoting.