NewsPublished 12 Aug 2026

"City-Forum" data-theft attacks target Salesforce, ServiceNow portals

Source Bleeping Computer

cloud

Description

A data theft campaign named "City-Forum" targets data exposed to anonymous users via Salesforce Experience Cloud and ServiceNow customer portals. The attackers use custom tools to steal this data. No specific affected software versions or patches are detailed. There is no indication of active exploitation in the wild or vendor advisories at this time.

Impact

The campaign results in unauthorized data theft from portals that expose information to anonymous users. The impact is limited to data confidentiality breaches involving Salesforce and ServiceNow customer portals. There is no evidence of broader system compromise or other impacts.

Defensive guidance

Organizations should review their portal configurations to limit data exposure to anonymous users and monitor for unusual access patterns. No official fixes or vendor advisories are referenced in the provided data.

Summary

The "City-Forum" campaign involves attackers leveraging custom tools to exfiltrate data accessible to anonymous users through Salesforce Experience Cloud and ServiceNow portals. The campaign focuses on exploiting data exposure in these customer-facing cloud portals. No detailed technical vulnerability or exploit code is provided, nor are specific affected versions or patches mentioned.

References

bleepingcomputer.com/news/security/city-forum-data-theft-attacks-target-salesforce-servicenow-portals/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 Aug 2026, 23:11 UTC

References

Community reviews

Related threats