Workday and Salesforce Class Action Claims Companies Failed to Protect Consumer Data 2026
Two of Silicon Valley’s biggest tech giants face a class action lawsuit over a 2025 data breach that exposed millions of consumers’ personal information. Plaintiffs Juan Elias and Saroj Panigrahy filed suit in California federal court claiming Workday and Salesforce failed to prevent a highly preventable data breach involving techniques and vulnerabilities known to the defendants in advance.
Workday confirmed in August 2025 that it had been targeted by threat actors who accessed information via a recent social engineering campaign. The breach exposed names, addresses, dates of birth, driver’s license numbers, and partial Social Security numbers of millions of consumers.
What Happened in the Workday and Salesforce Data Breach
The 2025 cyberattack targeted Salesforce’s Data Loader portal, used by Workday to import or export Salesforce data, which was “easily mimicked” by bad actors. Hackers used sophisticated voice phishing tactics to trick employees into granting access.
According to court documents, Salesforce warned its customers about the specific type of voice phishing attack that would be used against Workday, yet the defendants allegedly failed to implement fundamental security measures to prevent the breach.
The lawsuit was filed as Case No. 3:26-cv-00725 in the U.S. District Court for the Northern District of California in early 2026.
Who Is Affected by This Data Breach
Millions of consumers whose information was processed through Workday’s systems are potentially affected. The compromised data includes sensitive personal identifiable information (PII) that hackers specifically target for identity theft and fraud.
If you received a data breach notification letter from Workday, Salesforce, or your employer mentioning this incident, your information was likely compromised. Similar Conduent Data Breach Class Action 2026 10 Feb Update, 25M+ Victims, 10+ Lawsuits Filed—Free Credit Monitoring Deadline March 31 cases show healthcare and HR data breaches can affect tens of millions.
The breach particularly impacts employees and job applicants at companies using Workday’s HR platform, which serves over 11,000 organizations worldwide.
What Personal Information Was Stolen
According to the lawsuit, hackers accessed:
Names and home addresses. Dates of birth. Driver’s license numbers. Partial Social Security numbers. Employment and HR records.
This information creates serious identity theft risks. Criminals can use these data points to open fraudulent accounts, file fake tax returns, or steal medical benefits.
What the Class Action Lawsuit Claims
The plaintiffs accuse Workday and Salesforce of negligence, breach of implied contract, unjust enrichment, and violations of California’s Consumer Privacy Act and Unfair Competition Law.
Elias and Panigrahy argue that, as a result of the data breach, they and class members have suffered injuries, including invasion of privacy, lost time and expenses mitigating the risk of data misuse, and a diminishment in the value of their PII.
The lawsuit demands a jury trial and requests declaratory and injunctive relief plus actual, statutory, nominal, consequential and punitive damages for all class members.
Is There a Settlement Yet?
No settlement exists as of February 2026. The lawsuit is in early litigation stages with no claim deadline or compensation amounts established yet.
This differs from settled cases like the Under Armour Class Action, Company Failed To Protect Customer Data In 343 GB Breach where specific settlement terms and claim procedures are already in place.
Data breach class actions typically take 18-36 months from filing to settlement approval. Given the January 2026 filing date, negotiations likely won’t conclude until late 2026 or 2027.
What You Need to Know About Eligibility
You may be part of this class action if you received a data breach notification about the 2025 Workday incident. The plaintiffs want to represent a nationwide class of individuals whose PII was compromised.
Save all breach notification letters. These serve as proof you’re part of the affected class and establish your eligibility for future compensation.
You don’t need to take action now to join the lawsuit. If the court certifies the class, affected individuals are automatically included unless they opt out.
Common Mistakes Victims Make
Don’t ignore breach notification letters. Many victims throw them away thinking they’re spam, but these documents prove your eligibility.
Failing to document losses is another critical error. Start tracking any time spent addressing the breach, credit monitoring costs, or fraudulent charges not reimbursed elsewhere.
Don’t wait to protect your identity. Criminals often act quickly, selling stolen information on the dark web long before settlements are reached.
How This Connects to Other Workday Lawsuits
This data breach case is separate from the Workday AI Bias Lawsuit, Why Millions Were Rejected By Algorithms And The 2026 “Opt-In” Payout Deadline which involves age discrimination claims with a March 7, 2026 deadline.
The AI bias lawsuit requires proactive opt-in, while the data breach case automatically includes affected individuals unless they opt out.
What to Do Right Now
Change all passwords immediately, especially if you used the same password across multiple accounts. Enable two-factor authentication on email, banking, and financial services.
Monitor your credit reports from Equifax, Experian, and TransUnion for unauthorized accounts. You’re entitled to free reports at AnnualCreditReport.com.
Watch for phishing emails claiming to be from Workday or Salesforce. Legitimate notifications won’t ask for passwords or payment information.
When Legal Advice May Help
Consult an attorney if you’ve experienced identity theft, fraudulent charges, or significant time losses addressing the breach. Individual lawsuits may recover higher damages than class action settlements.
Data breach lawyers can evaluate whether you have additional claims beyond what the class action covers.
Frequently Asked Questions
What is the Workday and Salesforce data protection class action about?
The lawsuit alleges both companies failed to implement adequate security measures to prevent a 2025 data breach that exposed millions of consumers’ personal information through voice phishing attacks targeting Workday’s use of Salesforce’s Data Loader portal.
Am I eligible to file a claim in this class action?
If you received a breach notification letter from Workday, Salesforce, or your employer about the 2025 incident, you’re likely eligible. No claim filing is required yet since the case hasn’t reached settlement.
What is the claim deadline?
No claim deadline exists yet because the lawsuit hasn’t settled. The case was filed in January 2026 and remains in early litigation stages. Watch for official settlement notices in late 2026 or 2027.
How much compensation can I receive?
Compensation amounts aren’t established yet. Similar Panera Bread Data Breach Class Action Lawsuits, Two Separate Incidents, $2.5M Settlement Approved Plus New January 2026 Breach Affecting 14 Million cases show settlements typically range from pro-rata cash payments to thousands for documented losses.
What documentation do I need to file a claim?
Save your breach notification letter, receipts for credit monitoring services, records of time spent addressing the breach, and documentation of any fraudulent charges not reimbursed by banks or credit card companies.
How do I submit my claim?
No claim submission process exists yet. When settlement is reached, affected individuals will receive official notices with claim forms and submission instructions. Sign up for updates at class action tracking websites.
When will I receive my settlement payment?
Payments won’t be distributed until settlement is reached and court-approved, likely 60-90 days after final approval. Given the January 2026 filing, expect no payments before late 2026 at earliest.
Last Updated: February 11, 2026
Disclaimer: This article provides general information about the Workday and Salesforce class action lawsuit and is not legal advice.
What to Do Next: Monitor your credit reports, save all breach notifications, and watch for official settlement announcements as this litigation develops.
Stay informed, stay protected. — AllAboutLawyer.com
About the Author
Sarah Klein, JD, is a licensed attorney and legal content strategist with over 12 years of experience across civil, criminal, family, and regulatory law. At All About Lawyer, she covers a wide range of legal topics — from high-profile lawsuits and courtroom stories to state traffic laws and everyday legal questions — all with a focus on accuracy, clarity, and public understanding.
Her writing blends real legal insight with plain-English explanations, helping readers stay informed and legally aware.
Read more about Sarah