A year-long campaign is quietly draining Salesforce and ServiceNow tenants
August 18, 2026. From issue 2 of The Compliance Brief, one story for companies buying a SOC 2 audit.
Issue 2 of The Compliance Brief went to subscribers on August 18, 2026. One of its 5 stories bears on SOC 2 audits, auditors and vendor reviews, and they are below in short form. The full issue, with every take in full, is on traztech.ca.
Free weekly email
Get the next issue on Tuesday
One email a week: what changed in security and compliance, and what it means for companies buying a SOC 2 audit.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.
Source: Dark Reading
Dark Reading reports on a campaign tracked as City-Forum, active since at least March 2025, that has been stealing data from Salesforce and ServiceNow tenants using custom tooling. Targets span multiple sectors.
Our take, in short
Most SOC 2 scopes I read draw a boundary around the product and leave the CRM outside it, which is a fiction, because the CRM holds contract terms, support tickets with customer data pasted in, and often production credentials someone shared in a case comment. The attack path here is rarely the platform itself, it is a third-party app with...
Read the full take on traztech.ca
Related on GetSOC2
- How much does SOC 2 cost in Canada?
- How to read a SOC 2 report you received
- SOC 2 and Canadian data residency
- SOC 2 audit cost: the auditor's fee
Also in issue 2
Outside SOC 2 audits, auditors and vendor reviews, but in the same email:
- An AWS key in a public JavaScript bundle took down 1,000 charity CRMs
- The LiteLLM fallout is a CI credential problem, not an AI problem
- Metabase SQL injection is now on the KEV list
- When the subprocessor is breached, your customer writes the letter with your name in it
Older: issue 1 All issues on GetSOC2 Newer: issue 3
Free weekly email
Get it every Tuesday
The next issue goes out Tuesday morning. Read it in your inbox instead of finding it here a week later.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.