City-Forum campaign steals data from misconfigured Salesforce and ServiceNow portals

Researchers at Reco detailed a long-running data-theft campaign they call City-Forum that has been quietly stealing records from Salesforce and ServiceNow customer portals since at least March 2025. Rather than exploiting a platform vulnerability, the attacker uses custom tooling to pull data that organizations mistakenly exposed to anonymous guest users through overly permissive sharing rules and portal settings. It targets Salesforce Experience Cloud sites and a poorly documented ServiceNow portal search endpoint, hitting telecoms, banks, software vendors, security firms, and public-sector portals worldwide. All activity traces to a single server, and one victim alone saw over half a million data enumeration requests.

Check

Audit guest-user permissions and sharing rules on Salesforce Experience Cloud and ServiceNow portals, disable guest access to public APIs and unused self-registration, and confirm sensitive data is not reachable anonymously.

Affected

Organizations exposing Salesforce or ServiceNow portals with overly permissive guest access; attackers can enumerate and steal accounts, contacts, cases, and other records without any credentials or platform exploit.

Fix

Apply least privilege to guest profiles, remove broad API permissions, monitor the portal search and Aura endpoints for automated enumeration, and treat anonymously reachable data as effectively public until proven otherwise.