A threat actor has been quietly scraping data from misconfigured Salesforce and ServiceNow portals worldwide — and the campaign has been running since at least March 2025.

Security researchers at Reco discovered the operation, which they’ve named City-Forum. It targets organisations that have accidentally left customer data accessible to anonymous visitors through overly permissive portal settings.

This isn’t a software vulnerability. It’s a configuration problem — and it’s far more common than most businesses realise.

What’s happening

The attacker uses custom tools to probe Salesforce Experience Cloud and ServiceNow Service Portals for data that guest (unauthenticated) users can access. If your portal’s sharing rules are too open, they’re pulling whatever they can reach: contacts, cases, account records, and potentially sensitive customer information.

Reco reports that one targeted organisation logged more than 560,000 enumeration events from the attacker’s IP address alone. The campaign has hit telcos, banks, enterprise software vendors, and public-sector organisations across multiple countries.

Why Australian businesses should care

If your business runs a Salesforce or ServiceNow customer portal, this is worth 15 minutes of your time today. We regularly see Australian organisations — particularly in financial services and professional services — stand up customer portals without fully locking down what guest users can access. Under the Privacy Act’s Notifiable Data Breaches scheme, exposed personal information could trigger a mandatory disclosure even if the data was technically public through a misconfiguration you didn’t know about.

What to do

For Salesforce: review your guest-user sharing rules, object and field permissions, and self-registration settings. On newer LWR sites, disable the option that lets guest users access public APIs unless you specifically need it.

For ServiceNow: check which search sources are exposed through your Service Portal and make sure sensitive data requires authentication.

If you’re not sure whether your portal configuration is exposing data it shouldn’t, get in touch. A quick permissions audit takes minutes and could save you a breach notification.