City-Forum Data Theft Campaign Targets Multiple Orgs Worldwide
A data theft campaign, dubbed City-Forum by SaaS security firm Reco, has been targeting multiple organizations worldwide. The attacks use custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals.
The campaign has targeted telecommunications companies, banks and financial services firms, enterprise software vendors, security and data privacy companies, and public-sector portals. Reco says all of the attacks originate from a single server IP address, 158.220.87.79, hosted by German VPS provider Contabo.
Reco notes that these attacks are not exploiting vulnerabilities in Salesforce or ServiceNow but rather stealing data that organizations have mistakenly exposed to unauthenticated guest users through overly permissive sharing rules, permissions, or portal configurations.