threat-intel Long-running Data Theft Campaign Targeting Salesforce, ServiceNow The "City-Forum" campaign, active since March 2025, has seen a threat actor targeting Salesforce and ServiceNow instances with custom tools to steal data. Unlike traditional attacks relying on publicly available tools, this actor has developed unique techniques to exploit less-documented interfaces, specifically the da… Dark Reading · Aug 12, 2026 High USCAGBsalesforceservicenowguest access
threat-intel Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset A sophisticated and innovative campaign, dubbed ‘City-Forum,’ is targeting Salesforce and ServiceNow using a custom multi-platform toolset. The attackers are exploiting unauthenticated guest user access to gather data, p… SecurityWeek · Aug 12, 2026 High guest userunauthenticated accessdata exfiltration
data-breach Brinks Home Discloses Data Breach as Hackers Leak Files Brinks Home disclosed a data breach, with the extortion group ShinyHunters claiming to have stolen over 41GB of data from the company's Salesforce instance. The attackers have now publicly released the stolen information… SecurityWeek · Aug 3, 2026 Medium data breachsalesforcetor
data-breach Scope of Salesforce Attacks Expands as Icarus Leaks Data A series of attacks originating from the Icarus extortion group have expanded the scope of breaches affecting Salesforce customers. Initially targeting Klue’s OAuth tokens, attackers leveraged this access to steal custom… Dark Reading · Jun 23, 2026 High USsalesforceoauthdata breach
supply-chain Klue OAuth breach victim list grows as Icarus hackers claim attack A security breach at Klue, a market intelligence platform, has resulted in the theft of OAuth tokens used to connect to customer Salesforce environments. The attack, attributed to the ‘Icarus’ extortion group, impacted m… BleepingComputer · Jun 19, 2026 High USoauthsalesforcedata breach
supply-chain Cybersecurity Firms Impacted by Klue Supply Chain Attack A supply chain attack targeting the Klue market intelligence platform resulted in the unauthorized harvesting of customer data from various integrations, including Salesforce and HubSpot. The attack, attributed to a new… SecurityWeek · Jun 19, 2026 High supply-chainoauthcrm
threat-intel Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data Salesforce disabled the Klue Battlecards app integration following a security incident where the Icarus extortion group exploited compromised credentials to access customer data via Salesforce. The attackers leveraged a… The Hacker News · Jun 19, 2026 High USoauthcredentialdata-exfiltration
data-breach Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks A recent breach at Klue, a market intelligence platform, allowed the "Icarus" threat actor to steal Salesforce CRM data from multiple organizations, triggering an ongoing extortion campaign. The attackers leveraged stole… BleepingComputer · Jun 18, 2026 High USoauthsalesforcedata theft
data-breach Charter Communications data breach affects 4.9 million accounts Charter Communications experienced a data breach impacting approximately 4.9 million accounts following a sophisticated attack by the ShinyHunters extortion gang. The attackers gained access through a voice phishing (vis… BleepingComputer · May 29, 2026 High USCHdata breachvishingsalesforce
data-breach Charter confirms data breach after ShinyHunters extortion threat Charter Communications has confirmed a data breach following a threat from the ShinyHunters extortion group, resulting in the claimed theft of 40 million customer records. The breach originated from a voice phishing atta… BleepingComputer · May 26, 2026 High voice phishingdata breachsalesforce
data-breach 7-Eleven data breach exposes personal information of 185,000 people 7-Eleven experienced a data breach following a cyberattack by the ShinyHunters extortion gang, exposing the personal information of over 185,000 individuals. The attackers gained access to 7-Eleven’s systems, primarily a… BleepingComputer · May 26, 2026 High DEdata breachsalesforceextortion
