ServiceNow tells customers a bug left some of their data exposed to the internet

ServiceNow, a prominent player in cloud technology, has alerted some of its enterprise clients about a troubling software vulnerability that inadvertently exposed their data to the internet. According to a knowledge base article that has circulated on Reddit—though hidden behind a login barrier—the company implemented a patch on June 5 to rectify the issue in certain customer instances. This bug allowed unauthorized users to gain unexpected access to sensitive information stored on the ServiceNow platform. The flaw permitted anyone on the internet to retrieve data from customer accounts without needing any form of credentials, such as passwords. The specifics surrounding who may have accessed this data, what information was compromised, or whether any specific groups were involved remain unclear. As the incident appears to stem from a bug that exposed data, it raises questions about whether affected customers could have taken steps to safeguard their information. ServiceNow is widely recognized for facilitating automation of internal business processes for thousands of enterprises. Its platform enables users to create workflows that connect various applications and databases, including IT and HR systems, effectively streamlining repetitive tasks like onboarding new employees and managing tech support tickets. Given the sensitive nature of the data handled—such as customer support logs that may contain passwords and credentials—ServiceNow and similar companies are attractive targets for cybercriminals. While ServiceNow stated that the issue primarily concerns Australian customer instances, several users outside Australia have reported signs of unauthorized access to their own ServiceNow accounts. Network security experts have flagged an IP address, 51.159.98.241, as a potential indicator of compromise if it appears in a client's logs. A spokesperson for ServiceNow has yet to respond to inquiries from TechCrunch regarding the number of customers impacted and the duration of the data exposure.