Researchers at Reco have disclosed City-Forum, a data theft campaign that has spent seventeen months pulling records out of Salesforce and ServiceNow customer portals worldwide, all from a single rented server. No vulnerability was exploited and no credential was stolen. Every request arrived as an anonymous guest and read whatever overly permissive portal settings left open. Material exposed in such attacks has included Social Security numbers, medical and financial data, support tickets and internal correspondence. The busiest single victim logged more than 560,000 events, and the activity is still running.
Source: https://www.bleepingcomputer.com/news/security/city-forum-data-theft-attacks-target-salesforce-servicenow-portals/
GuardWare PROTECT keeps sensitive documents encrypted wherever they are stored or shared, including files attached to portal records and support tickets. A guest who can reach a file still cannot read it.
Related Blogs
The Outsourcers Answer: TCS and HCLTech Confront a Hacker’s Claims
Eight Agents, Four Days: AI Runs a Government Intrusion in Taiwan
Closer to Home: Origin Energy’s Breach Traced to a Manila Call Centre
284 Million Rows in Four Days: McKesson’s Cloud Warehouses Emptied
How an SME Built a Security Posture That Enterprise Clients Trust
