As cited
Copy frozen at (site build).
cloud saas
A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months
Researchers at Reco identified a campaign named City-Forum, in which an attacker has been extracting records from Salesforce and ServiceNow customer portals globally for at least 17 months. The attacker operates from a compromised server using a dormant domain registered in 2002, exploiting portal access that functions as intended without triggering typical breach detection signals.
Why it matters: Organizations using Salesforce or ServiceNow customer portals need to audit portal access logs and data exposure immediately, as the activity is ongoing and affects customers worldwide.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
cloud saas
A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months
Researchers at Reco identified a campaign named City-Forum, in which an attacker has been extracting records from Salesforce and ServiceNow customer portals globally for at least 17 months. The attacker operates from a compromised server using a dormant domain registered in 2002, exploiting portal access that functions as intended without triggering typical breach detection signals.
Why it matters: Organizations using Salesforce or ServiceNow customer portals need to audit portal access logs and data exposure immediately, as the activity is ongoing and affects customers worldwide.
- Source published
- First seen by Cybersecurity Tracker