--- title: Salesforce, ServiceNow data targeted in ‘City-Forum’ attacks description: Security researchers at Reco have identified a new attack campaign dubbed 'City-Forum' targeting Salesforce and ServiceNow systems, exposing user data. The... canonical: https://daily.dev/posts/salesforce-servicenow-data-targeted-in-city-forum-attacks-pl29t4ygq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Salesforce, ServiceNow data targeted in ‘City-Forum’ attacks | daily.dev og:description: Security researchers at Reco have identified a new attack campaign dubbed 'City-Forum' targeting Salesforce and ServiceNow systems, exposing user data. The... og:url: https://daily.dev/posts/salesforce-servicenow-data-targeted-in-city-forum-attacks-pl29t4ygq og:image: https://api.daily.dev/og/posts/PL29T4ygq.png og:image:alt: Salesforce, ServiceNow data targeted in ‘City-Forum’ attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Salesforce, ServiceNow data targeted in ‘City-Forum’ attacks **[CSO Online](https://daily.dev/sources/csoonline)** · 2 min read · 0 upvotes · 0 comments ## Summary Security researchers at Reco have identified a new attack campaign dubbed 'City-Forum' targeting Salesforce and ServiceNow systems, exposing user data. The attack shares similarities with tactics used by extortion group ShinyHunters, but introduces new techniques: exploitation of the UI-API layer and a native ServiceNow Service Portal search endpoint with minimal documentation. Attackers reportedly built custom tooling and mapped common data-leak vectors, suggesting a sophisticated operation. The report underscores the importance of tightly controlling credential access for SaaS platforms. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the City-Forum attack campaign targeting Salesforce and ServiceNow? City-Forum is an attack campaign identified by security researchers at Reco that targets Salesforce and ServiceNow systems to expose user data. It resembles tactics used by the extortion group ShinyHunters but uses a new technique: penetrating systems through the UI-API layer, an entry point not previously observed, along with custom-built attacker tooling. _Teams running Salesforce or ServiceNow can track emerging SaaS attack techniques like this on daily.dev._ ### How are attackers exploiting ServiceNow in the City-Forum campaign? Attackers are targeting a native ServiceNow Service Portal search endpoint that has almost no online documentation and no well-known open-source tooling around it. Combined with UI-API layer exploitation, this suggests attackers studied the platform closely to map common data-leak vectors, indicating an advanced, deliberate approach rather than opportunistic scanning. _Security teams hardening ServiceNow deployments follow findings like this via daily.dev._ ## Similar posts on daily.dev - [ServiceNow discloses security incident exposing customer data](https://daily.dev/posts/servicenow-discloses-security-incident-exposing-customer-data-uu7it8cfu) · BleepingComputer · 2 upvotes · 0 comments - [PeopleSoft 0-day affecting hundreds of organizations steals gigabytes of data](https://daily.dev/posts/peoplesoft-0-day-affecting-hundreds-of-organizations-steals-gigabytes-of-data-rbusirs36) · Ars Technica · 0 upvotes · 0 comments - [ServiceNow tells customers a bug left some of their data exposed to the internet](https://daily.dev/posts/servicenow-tells-customers-a-bug-left-some-of-their-data-exposed-to-the-internet-2sypghmj4) · TechCrunch · 0 upvotes · 0 comments - [Salesforce Agentforce vulns allowed 0-click CRM data theft, anonymous phishing](https://daily.dev/posts/salesforce-agentforce-vulns-allowed-0-click-crm-data-theft-anonymous-phishing-lnxc3zf0p) · The Register · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-breach](https://daily.dev/tags/data-breach), [#salesforce](https://daily.dev/tags/salesforce) [View this post on daily.dev](https://daily.dev/posts/salesforce-servicenow-data-targeted-in-city-forum-attacks-pl29t4ygq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Salesforce, ServiceNow data targeted in ‘City-Forum’ attacks","url":"https://daily.dev/posts/salesforce-servicenow-data-targeted-in-city-forum-attacks-pl29t4ygq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/salesforce-servicenow-data-targeted-in-city-forum-attacks-pl29t4ygq"},"datePublished":"2026-08-14T13:35:39.684Z","dateModified":"2026-08-14T13:53:56.859Z","description":"Security researchers at Reco have identified a new attack campaign dubbed 'City-Forum' targeting Salesforce and ServiceNow systems, exposing user data. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1ba1ca6a8656c0918d403c8d56d44345?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1ba1ca6a8656c0918d403c8d56d44345?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/salesforce-servicenow-data-targeted-in-city-forum-attacks-pl29t4ygq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-breach,salesforce","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Salesforce, ServiceNow data targeted in ‘City-Forum’ attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/salesforce-servicenow-data-targeted-in-city-forum-attacks-pl29t4ygq#faq","mainEntity":[{"@type":"Question","name":"What is the City-Forum attack campaign targeting Salesforce and ServiceNow?","acceptedAnswer":{"@type":"Answer","text":"City-Forum is an attack campaign identified by security researchers at Reco that targets Salesforce and ServiceNow systems to expose user data. It resembles tactics used by the extortion group ShinyHunters but uses a new technique: penetrating systems through the UI-API layer, an entry point not previously observed, along with custom-built attacker tooling. Teams running Salesforce or ServiceNow can track emerging SaaS attack techniques like this on daily.dev."}},{"@type":"Question","name":"How are attackers exploiting ServiceNow in the City-Forum campaign?","acceptedAnswer":{"@type":"Answer","text":"Attackers are targeting a native ServiceNow Service Portal search endpoint that has almost no online documentation and no well-known open-source tooling around it. Combined with UI-API layer exploitation, this suggests attackers studied the platform closely to map common data-leak vectors, indicating an advanced, deliberate approach rather than opportunistic scanning. Security teams hardening ServiceNow deployments follow findings like this via daily.dev."}}]} ```