Should SaaS Companies Publish Customers Lists?
Summary: Workday sent customers a security advisory warning that they were being targeted by malware phishing attacks while its own site published a list of more than 800 companies using its services, and the site's sign-in search page produced customer-specific login pages for any listed company. Krebs compared this to POS providers that list every customer and are targeted by Russian malware gangs because that list is the easiest route into customer cash registers, while Workday said spotlighting shared customer success helps its business grow and that security remains its top priority.
What you should know: Nine times out of ten, Krebs writes, when a financial institution cannot trace fraudulent card transactions to a source, the culprit is a third-party POS provider that lists every one of its customers on its site - the same targeting shortcut a published customer roster hands to phishers impersonating the vendor.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026