Single Attacker Harvests Data from Public Salesforce and ServiceNow Portals Since 2025

A single threat actor has been automatically harvesting data from publicly accessible portals belonging to Salesforce and ServiceNow since 2025, according to a security report. Scraping, the automated copying of information from web pages, is not a traditional break-in. It uses the same access any visitor has, but at high speed and large scale. The two cloud platforms are used by thousands of companies for customer relationship management and IT service management, so the finding is a reminder that even well-known software-as-a-service providers cannot prevent customers from leaving data open to automated collection. A threat actor is a person or group that attempts to misuse computer systems or data.

Salesforce is a widely used online service for managing customer information, sales leads, and marketing campaigns. ServiceNow is a platform companies use to run IT support, employee self-service, and other internal workflows. Many organizations configure public portals on these platforms for customers, partners, or employees. These portals often show user profiles, support articles, forum posts, or ticket status pages. If a company does not require a login for those pages, anyone, including a scraper, can view and copy the information.

The attacker observed in this activity has been scraping both platforms since 2025, indicating a persistent, automated campaign rather than a one-time effort. The scraped data can include names, email addresses, job titles, company names, and sometimes the content of support requests or community discussions. While individual pieces may not be secret, a large collection becomes valuable. Attackers can use it to craft convincing phishing emails, guess passwords through credential stuffing (trying to log into many accounts using usernames and passwords stolen from other websites), or map an organization's internal structure for further attacks.

The incident is not a data breach in the traditional sense. No accounts were broken into, and no private databases were accessed. Instead, the attacker simply collected what was already visible. This makes it harder for target organizations to detect, because the traffic may look like normal web browsing. However, security teams can look for signs of scraping: an unusually high number of page requests from a single IP address, rapid navigation through many pages, or the use of known scraping tools. Many organizations do not monitor their public portals closely enough to notice.

For website owners and IT teams, the takeaway is to treat every public page as a potential data source for attackers. Review what is visible without login, require authentication for anything sensitive, and limit the amount of personal or business information displayed. Both Salesforce and ServiceNow provide settings to restrict access to portals and communities. Rate limiting, which slows down automated requests, and CAPTCHAs, which ask users to prove they are human, can also reduce scraping. Monitoring for unusual traffic patterns is essential.

Because scraping targets the configuration of public-facing systems rather than a software vulnerability, the responsibility falls heavily on the organizations that run those portals. A security assessment from AEU-I can help businesses identify which pages are exposed, review access controls, and implement monitoring to detect and block automated scraping before it becomes a larger problem.