"City-Forum" data-theft attacks target Salesforce, ServiceNow portals
Security firm Reco says an ongoing “City-Forum” campaign uses a single server (IP 158.220.87.79, Contabo) to steal data exposed to anonymous users via Salesforce Experience Cloud and ServiceNow customer portals. Reco reports rising activity, heavy Salesforce Aura enumeration, some Lightning Web Runtime GraphQL abuse, and ServiceNow portal search endpoint abuse. No Salesforce/ServiceNow vulnerability is cited; misconfigured guest access is blamed.
How this was made
The 30-second read
Why it matters
The theft method relies on overly permissive guest sharing rules and portal/API configurations, including Salesforce Aura and LWR GraphQL enumeration and ServiceNow portal search abuse. The article provides concrete attacker workflow details (endpoints and enumeration steps) and notes prevention effectiveness drops after credentials are obtained.
Market read
This is a cybersecurity risk disclosure for two major enterprise SaaS platforms, but it emphasizes customer misconfiguration rather than a vendor vulnerability, limiting immediate fundamental trading catalysts.
What to watch
Traders may overreact to headline breach framing; the more actionable signal is whether affected customers or regulators later attribute systemic product responsibility or require vendor-level remediation.
Background
Reco’s City-Forum campaign targets data exposed to anonymous guest users through Salesforce Experience Cloud and ServiceNow customer portals, using a consistent infrastructure fingerprint since at least March 2025.
Ticker impact
Reco reports an ongoing City-Forum campaign abusing Salesforce Experience Cloud guest access via Aura and LWR API endpoints to enumerate and steal exposed records.
Near-term price impact is likely limited unless follow-on reporting shows Salesforce-specific systemic flaws or material customer harm.
The text says the attacks are not exploiting a Salesforce vulnerability, and it targets guest-user exposure caused by overly permissive sharing/permissions in customer environments.
The article says City-Forum also targets ServiceNow Service Portals using an anonymous POST search endpoint to enumerate and retrieve data from guest-permitted search sources.
Stock reaction is likely muted unless regulators or ServiceNow disclose a broader product-level issue or mitigation requirement.
Reco attributes the theft to guest access and search-source configuration permitting anonymous retrieval, not to an unpatched ServiceNow flaw.
Market effects
Highlights persistent misconfiguration risk in enterprise SaaS portal frameworks (Experience Cloud, Service Portals) and may increase demand for security hardening and monitoring.
No specific regional market impact is identified; targets are described as worldwide.
Could reinforce global enterprise security spending focus on access control, guest permissions, and API/portal exposure.
Counterpoint
Because the article explicitly says there is no Salesforce or ServiceNow vulnerability being exploited, the incremental financial impact to the vendors may be small versus the impact on affected customers’ security teams.
Key entities
- companySalesforce
Subject of the report via Salesforce Experience Cloud guest-user abuse using Aura and LWR API endpoints.
- companyServiceNow
Subject of the report via ServiceNow Service Portal search endpoint abuse to retrieve data from guest-permitted sources.
- security_firmReco
SaaS security firm attributing the campaign to City-Forum and tracing it to a single Contabo-hosted IP.
- vps_providerContabo
German VPS provider hosting the attacker IP address associated with the campaign.
