// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE BRC-wedgDTG 0600Z
ColdRecon / Breach Radar / Workday
Breach Record

Workday

DISCLOSED 2026-06-25 · STOLEN CREDS

Five malicious Chrome extensions were discovered stealing session cookies from enterprise SaaS applications including Workday, NetSuite, and SAP SuccessFactors. The extensions exfiltrated cookies every 60 seconds to attacker-controlled servers, bypassing password and MFA protections. This incident highlights the risk of session hijacking via browser extensions and the...

The record

What we know

Disclosed
2026-06-25
Attack vector
Stolen Creds
Sources

Cited reporting

↗ securityboulevard.com (2026-06-25)
Similar vector · recent

Other stolen creds breaches on file

Amgen Inc. · 2026-08-04 SplitVPN · 2026-07-21 Microsoft · 2026-07-02 Fluke · 2026-07-01 Houston City College · 2026-06-16 Sysco · 2026-06-15 Glendale Community College · 2026-06-15 June 2026 Stealer Logs · 2026-06-15

This page is the permanent ColdRecon entry for the Workday disclosure. It updates if new public reporting emerges. All tracked breaches →

Workday just lived through this. Your next prospect doesn't have to.

ColdRecon turns every disclosed breach into a daily intelligence brief from the seller's seat — normalized to the factors that move a deal, written in the Handler's voice. Request clearance and the first lands tomorrow at 0600.

Request Clearance →