Workday Data Breach Lawsuit: Tied to the Salesforce Case, No Settlement
Active Litigation
If you searched for the Workday Salesforce data breach, this is the case: in August 2025 Workday, the HR software company, said attackers had reached its third-party CRM platform through a phone-and-text social engineering campaign. A class action against Workday and Salesforce followed in January 2026. As of October 19, 2026, court records list Workday and the Elias plaintiffs in a larger consolidated case against Salesforce in San Francisco, but it is unclear whether claims against Workday are still being pressed there. There is no settlement, no claim form and no deadline.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened and What the Lawsuit Says
Workday disclosed in August 2025 that “threat actors were able to access some information from our third-party CRM platform.” It said there was “no indication of access to customer tenants or the data within them” — meaning the HR and payroll systems employers run on Workday — and that the information taken was “primarily commonly available business contact information, like names, email addresses, and phone numbers.” A customer notice put the discovery at August 6, 2025. The incident was one of a wave of attacks on companies' Salesforce databases.
The lawsuit goes further. It alleges the stolen records included names, addresses, dates of birth, driver's license numbers and partial Social Security numbers. It alleges Salesforce's Data Loader portal, which Workday used to move Salesforce data, was “easily mimicked” by the attackers, and that Salesforce had warned customers about this exact kind of voice phishing attack. The claims are negligence, breach of implied contract, unjust enrichment, and violations of California's Consumer Privacy Act and Unfair Competition Law. These are allegations; no court has found either company liable.
Case details
The Workday suit is Elias, et al. v. Workday, Inc., et al., No. 3:26-cv-00725 in the U.S. District Court for the Northern District of California, filed January 23, 2026 by plaintiffs Juan Elias and Saroj Panigrahy against Workday, Inc. and Salesforce, Inc.
Court records for In re Salesforce Customers Security Incident Litigation, No. 3:25-cv-07232, before Judge Jacqueline Scott Corley, list Workday, Inc. as a defendant and both Elias plaintiffs among the plaintiffs. On September 14, 2026 Judge Corley ruled on Salesforce's motion to dismiss (order on GovInfo). She dismissed only the fraud-based Illinois claims and the Washington claims based on an invasion-of-privacy injury; everything else survived, including the plaintiffs' standing to sue.
Status: Pending, Sent to Private ADR, No Settlement
One point is unclear from the public record. The September ruling describes the consolidated complaint as brought by customers and employees of Allianz, Farmers and TransUnion, and it was decided on Salesforce's motion alone — it does not mention Workday. Whether the claims against Workday are still being pressed in that complaint, we could not confirm. Either way, as of October 19, 2026 there is no settlement, no fund, no administrator, no claim form and no deadline.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Latest From the Court Docket
Recent entries in the federal case behind this page, taken from the court's own docket. We check it at least once a day; this list is as of Oct 19, 2026.
Case: In Re Salesforce Customers Security Incident Litigation, No. 3:25-cv-07232 (N.D. Cal.)
Oct 15, 2026
Pretrial Order
ECF No. 134
Oct 10, 2026
Order on Stipulation selecting Private ADR
ECF No. 132
Oct 9, 2026
Stipulation and Proposed Order selecting Private ADR
ECF No. 130
A docket entry is a step in the case, not a decision on who wins. Sources: the courts' PACER feeds and CourtListener (Free Law Project). Not legal advice.
Who Could Be Covered
The Elias complaint seeks a nationwide class of people whose personal information was compromised in the Workday data breach, which it says affected millions of consumers. Workday has not published a count of affected people, and we found no regulator filing that gives one.
Who that probably is: people whose details sat in Workday's own CRM — business contacts at customer companies, sales prospects and similar records. It is not, by Workday's account, the employee and payroll data that employers store in Workday. Using Workday at your job or applying for a job through a Workday portal does not by itself put you in this case.
You do not need to sign up. If a class is certified or a settlement is reached, a court-appointed administrator sends notice to class members.
What a Case Like This Pays
How cases like this one end
Our copy of the federal courts’ own case database covers 83,315 other statutory actions casesclosed in U.S. federal district courts between 2015 and 2026, 11.8% of them filed as class actions:
- 25.6% ended in a settlement recorded by the court. Another 22.4% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 25.6% and 47.9%.
- 7.4% were decided on a motion before any trial.
- 1 in 156 reached a trial (0.6%), after a median of 21.8 months.
- Median time from filing to the end of the case: 4.9 months.
- Only 1,756 of them (2.1%) record a money award at all; the median of those is $199,500.
These are base rates for this type of case (federal other statutory actions cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Workday Data Breach Timeline
August 6, 2025 — Breach Discovered
Per a Workday customer notice, the company discovers that attackers reached its third-party CRM platform.
August 2025 — Workday Goes Public
Workday says the data taken was mainly business contact information and that customer tenants show no sign of access.
January 23, 2026 — Elias v. Workday Filed
Two plaintiffs sue Workday and Salesforce in San Francisco federal court, No. 3:26-cv-00725, seeking a nationwide class.
September 14, 2026 — Most Claims Survive
In the consolidated Salesforce case, No. 3:25-cv-07232, Judge Corley denies most of Salesforce's motion to dismiss.
October 10, 2026 — Referred to Private ADR
The court approves the parties' choice of private dispute resolution. A pretrial order follows on October 15, 2026.
October 2026 — No Settlement
As of October 19, 2026 there is no settlement, no fund, no administrator, no claim form and no deadline.
Three Things to Watch For
This breach was itself a phone-and-text scam, and the stolen contact details are what the next one needs:
Calls or texts from “HR” or “IT”
Workday warned that the attackers contact employees by text or phone, pretending to be HR or IT, to get account access. Never read out a code or approve a login because a caller asked; hang up and call your help desk on a number you already have.
“Claim your Workday settlement”
There is no settlement and no claims site. A page or email asking for your Social Security number or a fee to “secure your payment” is collecting data, not filing a claim.
Mixing up the AI hiring case
Ads that say “Workday rejected you? Get paid” are about a different lawsuit over job-applicant screening. It has nothing to do with this breach, and no one needs a fee or your bank login to tell you whether you qualify for either.
Workday Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there a Workday Salesforce data breach settlement or claim form?
No. As of October 19, 2026 the case is pending in the Northern District of California and was referred to private dispute resolution on October 10, 2026. There is no settlement, no fund, no administrator, no claim form and no deadline.
How do I know if I have been affected by a data breach?
The reliable sign is a notice from the company that held your data. For this incident, Workday said the data was mainly business contact details from its own CRM, not the HR records employers keep in Workday. If you got a breach letter from Allianz, Farmers or TransUnion instead, see our Salesforce data breach page — those are separate breaches.
What data was exposed?
Workday said primarily names, email addresses and phone numbers. The lawsuit alleges more: addresses, dates of birth, driver's license numbers and partial Social Security numbers. That gap has not been resolved by any court.
Is Workday similar to Salesforce?
No. Workday makes HR and finance software that employers use for payroll and staff records. Salesforce is a customer relationship management platform that companies use to track their own customers and contacts. Workday was a Salesforce customer, and the breach hit its CRM, not its HR product.
What are the security vulnerabilities of Workday?
Workday said it found no sign of access to customer tenants. The lawsuit's theory is about the CRM side: it alleges Salesforce's Data Loader portal was easy to imitate and that voice phishing calls tricked staff into granting access. Those are allegations, not findings.
What does the private ADR referral mean?
The parties agreed to try a private dispute resolution process, and the court approved it on October 10, 2026. Settlement talks can come out of it, but so can nothing. Until a settlement is filed and approved, there is nothing to claim.
Is this the same as the Workday AI hiring lawsuit?
No. Mobley v. Workday, No. 3:23-cv-00770, is a separate case alleging Workday's applicant screening disqualifies people over 40. It concerns job applicants, not this breach.
What is worth doing right now?
Treat unexpected calls and texts from “HR” or “IT” with suspicion, since contact details were what was taken. Freeze your credit at all three bureaus if you are worried about identity theft — it is free and reversible. Keep any breach notice you received.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Salesforce Data Breach LawsuitsThe wider 2025 wave of Salesforce customer breaches, case by case
- TransUnion Data Breach LawsuitAnother Salesforce-linked breach, handled in its own federal MDL
- Data Breach Settlement CalculatorWhat comparable data breach settlements have paid per person
- Open Class Action SettlementsSettlements you can file a claim in right now, with deadlines