One attacker has been scraping exposed Salesforce and ServiceNow portals since 2025
Misconfiguration can turn a trusted business portal into a quiet source of valuable data.
SOURCE · The Hacker NewsTHE BRIEF
Researchers linked prolonged scraping of Salesforce and ServiceNow portals to a single attacker who targeted publicly reachable data and configurations across multiple organizations.
WHY IT MATTERS
The activity may look like ordinary web traffic and can continue without malware or a dramatic system outage. Repeated collection can still expose customer, case and operational information useful for fraud or extortion.
WHO SHOULD CARE
Salesforce and ServiceNow owners, SaaS administrators, privacy teams and organizations operating customer portals.
WHAT TO DO NOW
- Test portals as an unauthenticated visitor.
- Review export volume, enumeration patterns and unusual scraping.
- Apply least-privilege sharing and rate limits to exposed records.
VERIFICATION NOTE
Source basis: The Hacker News reporting. Organizations should validate their own exposure rather than assume every portal was affected.
SecBriefs adds context and practical guidance. Reporting remains credited and linked to the original publisher.