Executive Summary
The cybersecurity community has identified the "City-Forum" data theft campaign, a persistent and global operation that has quietly harvested sensitive corporate records for over 17 months. This campaign highlights a significant shift in threat actor methodology, as the perpetrators achieved widespread data exfiltration across hundreds of multinational enterprises without exploiting a single software vulnerability or CVE.
Instead, the campaign weaponized permissive anonymous guest user access permissions within Salesforce Experience Cloud and ServiceNow portals. By scraping millions of records, including customer support tickets, internal employee directories, proprietary case histories, and confidential communications, the threat actors have demonstrated the catastrophic potential of configuration-based exposures.
Deep-Dive Technical Analysis
1. Infiltration Vector: Misconfigured Guest User Profiles
Technical analysis of the exposure reveals that the attackers focused on a common architectural oversight rather than a code flaw.
* Campaign Identifier: "City-Forum" Campaign (analyzed by Reco, BleepingComputer, and HelpNetSecurity).
* Attack Technique: Anonymous Guest Access Abuse (CWE-276: Incorrect Default Permissions).
* Targeted SaaS Architectures: Salesforce Experience Cloud (Community Portals) and ServiceNow Service Portals / Knowledge Bases.
* Exploration & Extraction Mechanism: When organizations deploy public-facing community portals or knowledge bases, default configurations or administrative oversights often grant the unauthenticated "Guest User" profile read permissions to backend standard and custom objects. In Salesforce, this includes Accounts, Contacts, Cases, and Leads; in ServiceNow, this extends to Incidents, Requests, and User Records. Threat actors developed custom automated scraping scripts that queried public API endpoints—specifically Aura/Lightning endpoints and REST APIs—without requiring any form of authentication.
2. Dwell Time, Automation & Data Harvesting Scale
The operational lifecycle of the City-Forum campaign is defined by its stealth and efficiency.
* 17-Month Silent Dwell Time: Because the attackers operated entirely within the boundary of legitimate HTTP requests to publicly exposed APIs, their activity generated minimal anomalous telemetry. This allowed the campaign to evade traditional Web Application Firewalls (WAFs) and Endpoint Detection and Response (EDR) systems that typically look for exploit payloads rather than high-volume legitimate queries.
* Scraped Data Taxonomy: The exfiltrated records represent a goldmine for secondary attacks. The data includes customer PII (full names, emails, phone numbers), unredacted customer support tickets, internal infrastructure change requests, proprietary product bug reports, and executive contact directories.
* Monetization and Extortion Tactics: Threat intelligence indicates that this harvested data is currently being cross-referenced with breach databases on dark web forums. The information is utilized for downstream executive spear-phishing, business email compromise (BEC), and supply chain extortion.
Incident Metrics Summary Table
Parameter
Details
Campaign Codename
City-Forum Data Theft Campaign
Target SaaS Platforms
Salesforce Experience Cloud, ServiceNow Customer/Service Portals
Attack Methodology
Unauthenticated Guest Access Abuse / Automated Object Scraping
Vulnerability Status
Zero Exploits / Pure Configuration Oversight (CWE-276)
Active Dwell Window
Over 17 Months (Ongoing into Mid-August 2026)
Compromised Assets
Support Cases, Contact Lists, Internal Incident Logs, PII
Industry Impact & SaaS Configuration Governance
The City-Forum campaign underscores critical strategic gaps in how modern enterprises manage cloud identity and security posture.
The SaaS Shared Responsibility Fallacy
Organizations frequently assume that SaaS providers automatically enforce enterprise-grade data isolation. This campaign serves as a stark reminder that while the provider secures the infrastructure, access permissions and public portal sharing rules remain the sole responsibility of the customer.
Cascading Social Engineering Risks
The impact extends beyond the immediate data loss. Leaked customer support cases and internal ticket dialogues provide attackers with perfect contextual pretexting material. This allows for highly convincing identity-spoofing campaigns against corporate helpdesks, as attackers can reference specific, legitimate case details to bypass standard verification.
Actionable Recommendations & Mitigations
To defend against the City-Forum campaign and similar configuration-based threats, organizations should immediately implement the following:
1. Audit and Restrict Guest User Access: Immediately review public portal sharing rules. In Salesforce, ensure the enforcement of "Secure Guest User Record Access." In ServiceNow, verify that public role ACLs (Access Control Lists) do not expose sensitive backend tables.
2. Deploy SaaS Security Posture Management (SSPM): Implement continuous SSPM tooling to detect over-permissioned object models, public sharing rules, and unauthenticated API endpoints in real time.
3. Enforce Field-Level Security (FLS): Mask or restrict sensitive fields—such as PII, API keys, or internal comments—from public API responses. This protection should remain in place even if a parent object has public read permissions.
4. Monitor Anonymous API Ingestion Rates: Implement behavioral rate-limiting and anomaly detection on all public-facing SaaS API endpoints to flag and block bulk data enumeration patterns.