← Back to Feed
"City-Forum" data-theft attacks target Salesforce, ServiceNow portals
August 12, 2026 · BleepingComputer · Severity: MEDIUM
A data-theft campaign is exploiting Salesforce Experience Cloud and ServiceNow customer portals to steal information exposed to anonymous users. Attackers employ custom tools designed to extract data from misconfigured portal instances. This highlights the risk of excessive anonymous access in customer-facing platforms.
Key Takeaways
- Ongoing campaign uses custom tools to scrape anonymous data from customer portals.
- Salesforce Experience Cloud and ServiceNow portals are primary targets for data theft.
- Organizations should restrict anonymous access and monitor portal activity for abuse.