Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with terminated unauthorized access to third-party crm, and remediation measures with enhanced security awareness training, remediation measures with additional security controls, and communication strategy with public disclosure, communication strategy with customer reassurance via trusted channels, communication strategy with security awareness reinforcement, and and and third party assistance with independent forensic firm (unnamed), third party assistance with collaboration with salesloft, and containment measures with disabled drift connector, containment measures with revoked all associated oauth tokens, containment measures with removed residual integrations, and remediation measures with full audit of historical case text for credential disclosures, remediation measures with customer notifications for credential rotation, and communication strategy with direct customer notifications, communication strategy with public advisory via workday and salesloft trust portals, communication strategy with detailed mfa/step-up authentication guidance, and enhanced monitoring with user activity logs for unusual behavior (recommended to customers)..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Third-Party CRM Platform (via Compromised Employee Credentials) and Compromised OAuth credentials in Salesloft’s Drift application.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Business Contact Information, , Non-Sensitive Metadata, Business Operational Data and .

Third-Party Assistance: The company involves third-party assistance in incident response through Independent forensic firm (unnamed), Collaboration with Salesloft, .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Enhanced Security Awareness Training, Additional Security Controls, , Full audit of historical case text for credential disclosures, Customer notifications for credential rotation, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by terminated unauthorized access to third-party crm, , disabled drift connector, revoked all associated oauth tokens, removed residual integrations and .

Key Lessons Learned: The key lessons learned from past incidents are Human element remains a critical vulnerability in cybersecurity.,Third-party vendors can serve as attack vectors for breaching primary targets.,Social engineering tactics (e.g., impersonation via phone/SMS) are increasingly sophisticated.,Proactive employee training and awareness are essential to mitigate phishing risks.Third-party integrations (e.g., OAuth-based apps) introduce significant risk vectors.,Proactive monitoring of anomalous activity in SaaS environments is critical.,Regular audits of case text and support logs can mitigate inadvertent credential exposure.,Multi-factor authentication (MFA) and step-up authentication are essential for high-privilege operations.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Workday Official StatementUrl: https://www.workday.com/en-us/company/trust/security-trust.html, and Source: Workday Security Advisory, and Source: Salesloft Trust Portal Update (August 26, 2024).

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Disclosure, Customer Reassurance Via Trusted Channels, Security Awareness Reinforcement, Direct Customer Notifications, Public Advisory Via Workday And Salesloft Trust Portals and Detailed Mfa/Step-Up Authentication Guidance.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Workday Reassured Customers That No Proprietary Data Or Tenant Environments Were Compromised., Emphasized The Importance Of Verifying Communication Channels Before Sharing Sensitive Information., Customers Were Directed To Workday’S Security And Trust Webpage For Updates., Reminder: Workday Will Never Request Passwords Or Secure Details Via Phone., , Direct Notifications To Affected Customers, Public Guidance On Mfa And Credential Rotation, Rotate Credentials Transmitted Via Salesforce Cases., Audit Historical Case Text For Sensitive Data., Enforce Mfa And Step-Up Authentication., Review Drift Integration Configurations (If Applicable). and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Independent Forensic Firm (Unnamed), Collaboration With Salesloft, , User Activity Logs For Unusual Behavior (Recommended To Customers), .

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Terminated Unauthorized Access To The Crm System., Enhanced Employee Training On Social Engineering Tactics., Implemented Additional Security Measures (Details Undisclosed)., Reinforced Communication Policies To Prevent Credential Harvesting., , Disabling Vulnerable Drift Connector And Revoking Oauth Tokens., Engaging Forensic Firm For Comprehensive System Review., Issuing Customer Advisories For Credential Rotation And Mfa Enforcement., Publishing Detailed Guidance For Authentication Hardening., .

Last Attacking Group: The attacking group in the last incident was an Sophisticated Threat Actor (unknown affiliation).

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2024-08-26.

Most Significant Data Compromised: The most significant data compromised in an incident were Business Contact Information (Names, Email Addresses, Phone Numbers), , Business contact details, Support case identifiers, Tenant attributes (name, data center location), Product and service listings, Training course enrollments with certificates, Event logs and .

Most Significant System Affected: The most significant system affected in an incident was Third-Party CRM Platform and Workday’s Salesforce tenant (via Drift integration).

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was independent forensic firm (unnamed), collaboration with salesloft, .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Terminated Unauthorized Access to Third-Party CRM and Disabled Drift connectorRevoked all associated OAuth tokensRemoved residual integrations.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Training course enrollments with certificates, Product and service listings, Business contact details, Event logs, Business Contact Information (Names, Email Addresses, Phone Numbers), Support case identifiers, Tenant attributes (name and data center location).

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Multi-factor authentication (MFA) and step-up authentication are essential for high-privilege operations.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Implement multi-factor authentication (MFA) for all critical systems, including third-party platforms., Monitor dark web/underground forums for signs of stolen credentials or exposed data., Enhance employee training programs to recognize and report social engineering attempts (e.g., phishing, impersonation)., Reinforce communication policies (e.g., never request passwords via phone/SMS)., Adopt behavioral analytics to detect anomalous access patterns in real-time., Enforce MFA across all user accounts, especially for third-party integrations., Monitor user activity logs for unusual behavior., Conduct phishing awareness training and simulated assessments., Verify independent impact assessments for direct Drift customers., Implement step-up authentication for high-privilege operations., Follow Salesloft’s supplemental security guidance for Drift ecosystem hardening., Rotate all credentials shared via Salesforce cases. and Regularly audit third-party vendor security practices and access controls..

Most Recent Source: The most recent source of information about an incident are Workday Security Advisory, Salesloft Trust Portal Update (August 26, 2024) and Workday Official Statement.

Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.workday.com/en-us/company/trust/security-trust.html .

Current Status of Most Recent Investigation: The current status of the most recent investigation is Resolved (Unauthorized Access Terminated; Additional Security Measures Implemented).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Workday reassured customers that no proprietary data or tenant environments were compromised., Emphasized the importance of verifying communication channels before sharing sensitive information., Direct notifications to affected customers, Public guidance on MFA and credential rotation, .

Most Recent Customer Advisory: The most recent customer advisory issued were an Customers were directed to Workday’s Security and Trust webpage for updates.Reminder: Workday will never request passwords or secure details via phone. and Rotate credentials transmitted via Salesforce cases.Audit historical case text for sensitive data.Enforce MFA and step-up authentication.Review Drift integration configurations (if applicable).

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Third-Party CRM Platform (via Compromised Employee Credentials) and Compromised OAuth credentials in Salesloft’s Drift application.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Successful social engineering attack exploiting human trust.Inadequate verification of unsolicited communication (phone/SMS).Potential gaps in third-party vendor security controls., Insufficient protection of Drift’s OAuth credentials by Salesloft.Lack of granular access controls for third-party integrations in Salesforce.Potential over-reliance on single-factor authentication for high-risk operations..

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Terminated unauthorized access to the CRM system.Enhanced employee training on social engineering tactics.Implemented additional security measures (details undisclosed).Reinforced communication policies to prevent credential harvesting., Disabling vulnerable Drift connector and revoking OAuth tokens.Engaging forensic firm for comprehensive system review.Issuing customer advisories for credential rotation and MFA enforcement.Publishing detailed guidance for authentication hardening..