workday.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting workday.com, with a risk score of 100. The primary concern stems from 29,802 historical data breaches and 4,876 active infostealer logs, representing 85.9% and 14.1% of the total events, respectively. A notable surge in employee-related events occurred in January 2026, coinciding with a period of high client-related activity in September 2025 and March 2026. The prevalent malware families include LummaC2, Redline, and Rhadamanthys, suggesting a focus on credential harvesting and data exfiltration. The data originates from various geographic locations, with India and the United States being the most represented. Leak repositories show a heavy reliance on combolist sources and database dumps, indicating potential credential stuffing or data leakage from compromised systems. The high volume of data breaches and active infostealer logs, coupled with the prevalence of credential-harvesting malware targeting services like Workday, presents a critical risk. The timeline shows a significant spike in employee-related events in January 2026, which could indicate a large-scale compromise or credential stuffing attack targeting employee accounts. The focus should be on immediate incident response, including credential rotation for affected users, enhanced monitoring for suspicious activity on Workday and related services, and a thorough review of data access controls and security configurations to prevent further exploitation.