City-Forum tools steal data from Salesforce and ServiceNow portals
Source headline: "City-Forum" data-theft attacks target Salesforce, ServiceNow portals
Intelligence Summary
An ongoing data theft campaign uses custom tools to steal data exposed to anonymous users. The targeting focuses on Salesforce Experience Cloud and ServiceNow customer portals. The stolen information comes from what these portals make accessible publicly. The report indicates the activity is not limited to one platform, but spans both services. If you use these portal capabilities, review your exposure of anonymous-access data and investigate for signs of unauthorized access. Restrict or remove anonymous exposure of sensitive data and monitor for related suspicious activity.
Recommended Action
Confirm whether the affected technology is in use in your environment before deciding on remediation. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.