One machine in Germany has been quietly reading company support portals since March 2025
2026-08-19Security
Reco has tracked a single IP walking Salesforce and ServiceNow customer portals across telecoms, banks, software vendors and government. No exploit was involved: the guest user on those public sites could already read more than the site needed to show. One target logged over 560,000 events from that one address.