"City-Forum" data-theft attacks target Salesforce, ServiceNow portals
Ongoing 'City-Forum' data theft campaign targets Salesforce and ServiceNow portals.
A data theft campaign dubbed 'City-Forum' is actively targeting Salesforce Experience Cloud and ServiceNow customer portals worldwide. The attackers exploit misconfigurations that expose data to anonymous users, using custom tools to steal information from various sectors including finance, telecommunications, and public sector. This campaign is notable for its use of novel techniques against newer Salesforce frameworks and ServiceNow endpoints.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Reco?
Get an email when a new story names Reco, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe 'City-Forum' campaign demonstrates how misconfigured SaaS portals can expose sensitive organizational data to anonymous, unauthenticated users without any exploitation of software vulnerabilities. Attackers leveraged overly permissive access settings in Salesforce Experience Cloud and ServiceNow customer portals — configurations that organizations frequently overlook during deployment or after platform updates. This matters because SaaS platforms are often assumed to be 'secure by default,' leading teams to underinvest in reviewing access controls and permission models. The multi-sector targeting (finance, telecom, public sector) highlights that no industry is immune when foundational configuration hygiene is neglected. Novel techniques against newer Salesforce frameworks also suggest attackers are actively researching platform-specific misconfigurations faster than defenders are auditing them.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- SaaS security posture management (SSPM)
Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 158.220.87.79
- domain — city-forum.com