"City-Forum" Campaign Abuses Misconfigured Salesforce and ServiceNow Customer Portals to Steal Exposed Data

An ongoing data-theft campaign, tracked as "City-Forum," is using custom tooling to harvest data that is exposed to anonymous, unauthenticated users through Salesforce Experience Cloud and ServiceNow customer portal sites, according to a report from BleepingComputer.

What was reported

The activity does not rely on exploiting a vulnerability in Salesforce or ServiceNow themselves. Instead, the attackers are targeting portal instances where organizations have misconfigured guest/anonymous access, allowing data intended for internal or authenticated users to be reachable without credentials. The actors are reportedly using purpose-built tools to enumerate and scrape this exposed data at scale.

Why it matters for defenders

Experience Cloud and customer-portal deployments are common in organizations that expose case data, knowledge bases, or customer records to external users. Because the underlying platforms are not vulnerable in the traditional sense, this is a configuration and access-control problem rather than a patchable bug — meaning standard vulnerability management processes won't catch it. Any organization running public-facing Salesforce or ServiceNow portals, particularly those with guest user profiles or unauthenticated site access enabled, should treat this as a live exposure risk, not a theoretical one.

What defenders should watch for or do now

• Audit Salesforce Experience Cloud guest user profile permissions and sharing rules to confirm anonymous users cannot reach objects, fields, or reports beyond what is explicitly intended for public consumption.
• Review ServiceNow customer portal ACLs and widget/record-level access controls for similar unauthenticated exposure.
• Hunt for anomalous volumes of anonymous/guest-session API or portal requests, especially bulk record retrieval patterns or sequential ID enumeration, in platform access logs.
• Check for automated or scripted-looking traffic (unusual user agents, high request rates, non-human timing) hitting public portal endpoints.
• Where available, enable and review Salesforce Event Monitoring / ServiceNow audit logs for guest-user activity, and restrict guest access to the minimum required for legitimate anonymous use cases.

This is a developing story and details on scope, victim count, and the specific tooling involved remain limited at this stage. For the original reporting, see BleepingComputer's coverage.