CRM cyberattacks: Workday falls victim to the new ShinyHunters method

HR software giant Workday has confirmed it fell victim to one of the many CRM cyberattacks that perfectly illustrate the devastating new strategy of the ShinyHunters group. This new attack method targets customer relationship management systems to compromise the data of leading companies, marking a worrying shift in cybercriminal tactics.

The CRM cyberattack that hit Workday

Workday, which employs more than 19,300 people and serves more than 11,000 organisations including 60% of the Fortune 500, revealed last Friday that a CRM cyberattack had compromised its third-party customer management system. The attackers used social engineering, posing as HR or IT staff to deceive the company’s employees.

This CRM cyberattack gave the cybercriminals access to business contact information stored in the third-party CRM platform, including names, email addresses and phone numbers. Workday insists, however, that no customer systems or sensitive data were compromised in the attack.

ShinyHunters and the surge in CRM cyberattacks

The CRM cyberattack against Workday is part of a large-scale campaign run by the ShinyHunters group, which specifically targets large companies’ Salesforce instances. Cybersecurity experts have identified this method as a major tactical evolution in the digital threat ecosystem.

The list of victims of these CRM cyberattacks is impressive and includes Google, Cisco, Qantas, Pandora, Adidas, Louis Vuitton, Dior, Chanel and Tiffany & Co. This strategy shows how formidably effective it is to target CRM systems rather than companies’ core infrastructure.

The social engineering method behind CRM cyberattacks

CRM cyberattacks exploit a particularly sophisticated social engineering technique called voice phishing, or “vishing”. The cybercriminals contact employees by phone or message, posing as colleagues from HR or IT to gain access to CRM systems.

Once they have access, the attackers use malicious OAuth applications to connect to the target companies’ Salesforce instances. This method lets them download and steal entire databases, which are then used to extort the victims by email.

Why CRMs are prime targets

CRM cyberattacks are increasingly successful because these systems are particularly attractive targets for cybercriminals. CRM platforms store valuable customer information that is easy to monetise on the black market, while generally being less protected than companies’ critical systems.

Kevin Marriott, a cybersecurity expert at Immersive, explains that CRM cyberattacks are technically easier to carry out while remaining very effective. This combination of accessibility and profitability explains why more and more cybercriminal groups are adopting the method.

The impact of CRM cyberattacks on the ecosystem

These CRM cyberattacks reveal a systemic vulnerability in the modern digital ecosystem. Salesforce, the world leader in CRM solutions, had to issue a statement insisting that its core platform remains secure and that the incidents stem from human error, not technical flaws.

The company points out that customers play a crucial role in protecting their data, particularly given the growing sophistication of CRM cyberattacks. This shared responsibility highlights the complexity of cybersecurity challenges in an interconnected world.

Detecting and responding to CRM cyberattacks

Workday responded quickly to this CRM cyberattack by immediately cutting off the compromised access and strengthening its security measures. The company also warned that the stolen information could be used in future social engineering attempts against other organisations.

According to some sources, the CRM cyberattack was detected on 6 August, but Workday only communicated publicly a week later. This timeline raises questions about notification delays and corporate transparency in the face of these new types of incidents.

Protecting against CRM cyberattacks

To protect themselves against CRM cyberattacks, companies must adopt a multi-layered approach including employee awareness, multi-factor authentication and monitoring of connected OAuth applications. Strict identity verification procedures over the phone are also an essential safeguard.

Workday points out that it never contacts customers by phone to ask for passwords or sensitive information, using only its official support channels. This clear policy illustrates the good practices every company should adopt.

Conclusion

CRM cyberattacks represent a worrying development in the digital threat landscape. The Workday incident shows that even technologically advanced companies are not immune to these new attack methods, which skilfully exploit human trust and systemic interconnections.

The rise of CRM cyberattacks calls for a coordinated response combining technological vigilance, staff training and cooperation between players in the digital ecosystem to effectively counter this emerging threat.

---

Frequently asked questions