# Researchers link Salesforce and ServiceNow data sweeps to one active server

_Tuesday, August 18, 2026 at 7:30 AM EDT · Security · Developing · Tier 1 — Major_

Reco researchers say one server has been extracting records from Salesforce and ServiceNow customer portals across multiple industries since at least March 2025. The firm says the activity uses Salesforce guest-access paths, including Aura and UI-API requests, as well as a ServiceNow portal-search endpoint. Reco attributes the exposure mechanism to guest identities granted excessive access and provides log signatures and remediation guidance. It says the infrastructure remains active and has not attributed the campaign to a named group.

## Sources

- [The Hacker News](https://thehackernews.com/2026/08/one-attacker-has-scraped-both.html)

---
Canonical: https://techandbusiness.org/newswire/fc7MXQtJE7MVplSeHUCmRh
Retrieved: 2026-08-18T14:05:08.793Z
Publisher: Tech & Business (techandbusiness.org)