As reported by BleepingComputer, an active data theft campaign is leveraging purpose-built tooling to systematically harvest sensitive data from Salesforce Experience Cloud and ServiceNow customer portals — specifically targeting configurations that inadvertently expose data to unauthenticated or anonymous users. This campaign, being tracked under the name City-Forum, is a stark reminder that SaaS misconfiguration isn't a theoretical risk — it's an active attack surface being exploited right now.

Cloud Security Alert: This campaign, being tracked under the name City-Forum, is a stark reminder that SaaS misconfiguration isn't a theoretical risk — it's an active attack surface being exploited right now.

Why This Campaign Is More Dangerous Than It Appears

What makes City-Forum particularly insidious is that it doesn't rely on zero-day exploits or sophisticated malware. Attackers are walking in through the front door — doors that organizations left unlocked by accident. Customer-facing portals built on platforms like Salesforce Experience Cloud and ServiceNow are designed to be accessible, often to external partners, customers, or the general public. The fine-grained permission controls these platforms offer are powerful, but they demand careful configuration. A single misconfigured object permission, guest user profile setting, or sharing rule can expose entire record sets to the open internet.

The use of custom tooling signals that this is not an opportunistic, script-kiddie operation. The adversaries behind City-Forum have invested in automation — meaning they can enumerate and exfiltrate at scale, moving across multiple organizations quickly and quietly. This is a targeted, operationally mature campaign.

Who Is at Risk

Why This Campaign Is More Dangerous Than It Appears
Large enterprises and government entities running public-facing Salesforce Experience Cloud communities or ServiceNow Service Portals
Healthcare, financial services, and utilities sectors — industries that frequently use these platforms for customer engagement and often handle regulated data
Organizations that have undergone rapid digital transformation — fast deployments often mean security review shortcuts
Companies relying heavily on third-party implementation partners who may not have applied security hardening best practices

The data exposed through these portals can include PII, case records, contract details, support tickets, and internal documentation — all high-value targets for follow-on phishing campaigns, ransomware staging, or direct monetization on criminal marketplaces.

The Broader Implication: SaaS Misconfiguration Is the New Perimeter Failure

The perimeter has dissolved. The new exposure surface is every SaaS portal, API endpoint, and guest user configuration your organization has ever touched — and likely forgotten about.

City-Forum fits into a growing pattern that Shield53 has been tracking: adversaries are shifting away from attacking infrastructure and toward exploiting the configuration layer of trusted SaaS platforms. These platforms are broadly adopted, deeply integrated into business operations, and often managed by teams that sit closer to the business than to security. That's a dangerous combination.

Traditional perimeter security controls — firewalls, IDS/IPS, network segmentation — provide zero protection against this attack vector. You cannot block legitimate portal traffic without breaking the product. Detection and prevention must happen within the platforms themselves.

Shield53 Recommendations

Immediate Actions

  • Audit Guest/Anonymous User Profiles in Salesforce: Navigate to Setup → Profiles → Guest User profiles for every Experience Cloud site. Review every object permission, field-level security setting, and sharing rule. Revoke any access that cannot be explicitly justified.
  • Review ServiceNow ACLs and User Roles: Audit Access Control Lists (ACLs) for public-facing Service Portal pages. Ensure that unauthenticated roles cannot query sensitive tables such as sc_request, incident, or sys_user.
  • Enable Salesforce Shield or Event Monitoring: If not already deployed, activate API usage logging and anomaly detection to identify bulk data access patterns consistent with automated enumeration.
  • Search for Indicators of Enumeration: Review API and portal access logs for high-volume anonymous requests, sequential record ID traversal, or unusual geographic access patterns.
  • Disable Guest User Access Where Not Required: If your Experience Cloud site does not need anonymous access, disable the guest user entirely. This is the most effective mitigation.

Strategic Actions

  • Incorporate SaaS configuration audits into your quarterly security reviews using tools such as Salesforce's Security Health Check or third-party SSPM (SaaS Security Posture Management) solutions.
  • Require security sign-off on all new portal configurations and any changes to sharing rules, permission sets, or guest user profiles.
  • Brief your Salesforce and ServiceNow admin teams on this campaign and ensure they understand the risk model — not just the technical controls.
  • Consider engaging a specialized SaaS security firm to perform a targeted configuration review if you cannot validate your own posture quickly.

City-Forum is almost certainly not the only campaign of this type currently active. Organizations that fail to treat SaaS configuration as a first-class security concern will continue to be easy targets. The tools are cheap, the data is valuable, and the access is often sitting wide open. Don't wait for a breach notification to discover your exposure.