Mystery attacker spent a year raiding Salesforce and ServiceNow portals | SpinGraph: Bad-actor framing
description: SpinGraph analysis of The Register AI / Software's Mystery attacker spent a year raiding Salesforce and ServiceNow portals story: bad-actor framing, The Shield…
canonical: https://stuffthatspins.com/spin/mystery-attacker-spent-a-year-raiding-salesforce-and-servicenow-portals-theregistercom
markdown: https://stuffthatspins.com/spin/mystery-attacker-spent-a-year-raiding-salesforce-and-servicenow-portals-theregistercom.md
keywords: SaaS security
keywords: portal breach
keywords: unattributed attack
keywords: The Shield
keywords: narrative intelligence
published: 2026-08-13T13:32:00+00:00
modified: 2026-08-17T00:12:23.510744+00:00

Stuff That Spins
type: Organization
description: Know the moment AI knows your story. Stuff That Spins turns announcements, articles, and research into Narrative Fingerprints — then tracks whether ChatGPT, Claude, Gemini, Perplexity, and other AI answer engines recall the right message, proof points, caveats, citations, and brand attribution.

Mystery attacker spent a year raiding Salesforce and ServiceNow portals - theregister.com
type: NewsArticle
alternative headline: Mystery attacker spent a year raiding Salesforce and ServiceNow portals | SpinGraph: Bad-actor framing
description: SpinGraph analysis of The Register AI / Software's Mystery attacker spent a year raiding Salesforce and ServiceNow portals story: bad-actor framing, The Shield…
date published: 2026-08-13T13:32:00+00:00
date modified: 2026-08-17T00:12:23.510744+00:00
main entity of page: https://stuffthatspins.com/spin/mystery-attacker-spent-a-year-raiding-salesforce-and-servicenow-portals-theregistercom
is accessible for free: true
language: en-US
article section: ai
keywords: SaaS security, portal breach, unattributed attack
author: The Register AI / Software via Google News
publisher: Stuff That Spins
citation: https://news.google.com/rss/articles/CBMiygFBVV95cUxOekFkamNTdE9xeVFDeVYtS2NYc1NqVzdWcnFUQjNWeDQ3YWFmYjh5OUpPSnphTGpGc0RzbEFobjZJU096MkF5RnJLQWFkd2EwTGg4aGhoQmV0TWM0dDFNaEpJaE8zYW5wWERpUWd6Nm5GMDVOOWt…
about: SaaS security
about: portal breach
about: unattributed attack
about: Salesforce
about: ServiceNow
mentions: The Register AI / Software
mentions: Salesforce
mentions: ServiceNow
abstract: A single unknown attacker breached multiple enterprise SaaS portals over 12 months. Salesforce and ServiceNow were both compromised via portal access flaws—not core platform vulnerabilities. No attribution, motive, or scale of data loss is disclosed in the report.

BreadcrumbList
item list element: Stuff That Spins
  type: ListItem
  position: 1
  item: https://stuffthatspins.com/
item list element: Mystery attacker spent a year raiding Salesforce and ServiceNow portals - theregister.com
  type: ListItem
  position: 2
  item: https://stuffthatspins.com/spin/mystery-attacker-spent-a-year-raiding-salesforce-and-servicenow-portals-theregistercom

Spin Analysis: bad-actor framing
type: AnalysisNewsArticle
description: Emphasizes attacker persistence and stealth while minimizing vendor accountability for portal hardening, logging, or customer-facing access governance.
about: bad-actor framing
  type: DefinedTerm
  description: Responsible platform providers undermined by elusive threat actors.
  term code: The Shield
additional property: Spin Score
  type: PropertyValue
  value: 65
  unit text: percent
additional property: Narrative Risk
  type: PropertyValue
  value: moderate
additional property: AI Repetition Risk
  type: PropertyValue
  value: moderate
additional property: Likely AI Summary
  type: PropertyValue
  value: A mystery attacker breached Salesforce and ServiceNow portals for a year.
additional property: Narrative Frame
  type: PropertyValue
  value: Responsible platform providers undermined by elusive threat actors.
additional property: Missing Context
  type: PropertyValue
  value: Vendor response timelines; Whether affected customers were notified; Independent validation of the intrusion claims
additional property: How the Spin Works
  type: PropertyValue
  value: The framing combines vague temporal language ('a year'), anonymous agency ('mystery attacker'), and active verbs ('raiding') to evoke a persistent, skilled threat — which distracts from the mundane but critical question of whether portal access controls were properly scoped, logged, or audited. The claim outruns validation because no evidence is offered for duration, method, or scope — yet the narrative implies systemic platform exposure when the actual risk likely resides in customer implementation choices.
author: Stuff That Spins
is part of: Mystery attacker spent a year raiding Salesforce and ServiceNow portals - theregister.com

Extracted Claims
type: ItemList
item list element: ListItem
  position: 1
  item: Claim
    text: A mystery attacker spent a year raiding Salesforce and ServiceNow portals.
    appearance: Mystery attacker spent a year raiding Salesforce and ServiceNow portals
    author: The Register AI / Software via Google News

Key Statistics
type: Dataset
description: Extracted statistics from the source narrative
variable measured: campaign duration
  type: PropertyValue
  value: 12 months
  description: Duration of unauthorized access before detection