SECURITYTHE HACKER NEWS
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year. According to research published by agent security platform Reco, this activity was named the City Forum campaign and traces back to server 158.220.87.79.
Mentioned
Related Signal
Adjacent reporting
- Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths
- ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances
- ServiceNow discloses security incident exposing customer data
- FleetWave outage takes another turn. Chevin confirms crooks accessed customer data