A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months Most security stories start with something broken. This one starts with everything working as designed. Researchers at Reco have been tracking a campaign they call City-Forum, named after a domain registered in 2002, abandoned, and now resolving to a generic rented server from a German hosting provider. From that server, someone has been pulling records out of Salesforce and ServiceNow portals around the world. The activity has not stopped, and there is more of it than there was. Every request Reco has seen from this address arrived as a guest. The targets they can see span telecom operators, banks and financial-services firms, enterprise-software vendors including security and data-privacy companies,…