"City-Forum" data-theft attacks target Salesforce, ServiceNow portals
TL;DR
City-Forum attackers have been systematically stealing data from misconfigured Salesforce and ServiceNow portals since at least March 2025, exploiting guest-user access to enumerate and download customer records from banks, telcos, and financial firms. If your exchange or mixer relies on Salesforce or ServiceNow portals for customer onboarding or support, assume your guest-accessible data has been scraped unless your admin explicitly locked down object permissions and self-registration.
An ongoing data theft campaign uses custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals.
