Your customer portal may be readable by strangers

· · Security Infrastructure

If your business runs a customer portal, a partner login, a help centre, or a public support site on Salesforce or ServiceNow, here is an uncomfortable question. Can a complete stranger, with no account and no password, read what is inside it?

For a lot of organisations the honest answer is yes, and they do not know it. The data is not stolen through a clever attack. It is simply readable, because a setting that decides what an anonymous visitor can see was left more open than anyone intended.

What happened

Researchers at the SaaS security firm Reco uncovered a campaign they call City-Forum, after a domain linked to the attacker. The same server has been running since at least March 2025, roughly 17 months, working through Salesforce and ServiceNow portals belonging to telecoms firms, banks, software vendors, security companies, and public-sector bodies around the world. Reco says the activity is still going and increasing.

The method is the part worth understanding. The attacker is not breaking in. On Salesforce, it queries the data layer behind newer portal sites to pull back records that the site has been configured to show guest users. On ServiceNow, it uses a built-in search feature on the customer portal to do the same. In both cases it is asking the platform, politely and anonymously, for data the platform has been told anonymous people are allowed to see.

The busiest single target logged more than 560,000 of these requests. The tooling also checks whether a Salesforce site lets anyone register their own account, which can turn an anonymous visitor into a logged-in user who can see considerably more.

Reco's researcher Nitay Bachrach put the lesson in one sentence: "If the guest can read a record, so can anyone on the internet. That is not a platform vulnerability."

Why this is not a Salesforce or ServiceNow problem

It would be easy to read this as a story about two products and move on if you use neither. That misses the shape of it.

Neither platform has been breached. There is no patch to apply, because nothing is broken. Salesforce and ServiceNow are doing exactly what they were configured to do: show guest users the records marked as visible to guest users. The exposure comes from that configuration, and the configuration is yours.

This is the same pattern behind a long run of "cloud leaks" you have seen over the years. An online storage bucket set to public. A shared drive link that turned out to be visible to the whole company. A database left reachable from the internet with no password. The tool is not at fault. The default leans towards open or convenient, somebody sets it up in a hurry, nobody revisits it, and months later it turns out the front door was ajar the whole time.

The reason it goes unnoticed is that nothing looks wrong. There are no failed logins to alert on, because nobody logged in. The requests look like ordinary portal traffic. The data flows out looking exactly like the site working as designed, which, technically, it is.

What to check

You do not need to run either platform to take something from this. The question underneath it applies to any system that shows anything to the public: what, precisely, can someone see without logging in?

If you run Salesforce Experience Cloud or a ServiceNow customer portal:

  • Ask who set up guest access, and what it can reach. The guest user is a real account with real permissions. Someone chose what it can read when the site was built, often years ago. Have that reviewed against what actually needs to be public, which is usually far less.
  • Turn off self-registration unless you genuinely need it. If anyone can create their own account, anonymous access is not the ceiling on what an outsider can reach. Confirm whether it is on, and whether it should be.
  • Watch for the specific records guests can see, not just whether the login page loads. A portal can look perfectly locked down from the front page while quietly answering data requests underneath. The right test is what the platform will return to an unauthenticated request, which is a job for someone who knows where to look.

For everyone else, the transferable question is simpler. List the places your business shows information to people who are not logged in: the website, a portal, a shared folder, a status page, a booking system. For each one, ask what an anonymous visitor can actually retrieve, not what the home page displays. The gap between those two is where this kind of quiet leak lives.

How Steelwise can help

Working out what your public-facing systems actually expose to someone with no account, before somebody else works it out for you, is the kind of security review we do for smaller firms without a security team of their own. Get in touch.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.