Uncloaked: Even an API Security Testing Company Got Breached by an Unprotected Database
Three stories this time, all shaped the same way: an API that answered requests without properly checking who was asking, or a database that should never have been reachable at all. One of them happened to a company whose entire business is testing other people's APIs for exactly this.
1. A ServiceNow access-control gap let unauthenticated queries pull customer instance data
ServiceNow applied a security update on June 5, 2026 after confirming an access-control gap that let unauthenticated queries against certain table endpoints return data they shouldn't have. The company changed the affected endpoint configuration and directly notified customers where evidence showed successful table queries had actually occurred. What was exposed depended on the customer, ServiceNow environments commonly hold internal tickets, employee records, asset data, and operational documentation, all of it potentially reachable by a request that never had to prove it belonged there.
Why it matters: this is precisely the class of flaw structured API testing is built to catch, not "is there a login page," but "does this specific endpoint actually enforce authentication, or does it just assume the request came from somewhere legitimate." A wordlist of common paths won't find it. Testing the endpoint itself will.
2. A compromised third-party app gave attackers a path into Salesforce customer data
Salesforce disabled the Klue Battlecards app integration on its platform after detecting unusual activity tied to a security incident at Klue, a competitive intelligence company, on June 11, 2026. An extortion group called Icarus compromised Klue and used the app's existing connection into Salesforce to reach customer data, elevated access through the integration let the attacker change the app's configuration, steal stored credentials for connected databases, read anything reachable through those connections, and export it. Salesforce was explicit that this wasn't a vulnerability in its own platform, the exposure travelled in through a trusted third-party connection instead.
Why it matters: this is the API-security equivalent of the vendor-risk story we covered a couple of weeks ago, except here the "vendor" is a Salesforce app integration your team may have approved once and never thought about again. Every connected app with write access to your CRM is a credential store and a data pipe, whether anyone's still actively using it or not.
3. An API security testing company was breached by an unprotected database
The most pointed story of the three: APIsec, a company specializing in proactive, continuous API security testing, was found by researchers at UpGuard to have an unprotected database sitting exposed online. It held customer employee and user names, email addresses, and API security posture information, including whether two-factor authentication was enabled, itself a useful signal for an attacker deciding who to target. Some of the data dated back to 2018. APIsec initially described it as non-production test data before confirming it also included real corporate customer information and scan results once presented with evidence.
Why it matters: nobody is exempt from this failure mode by virtue of what they sell. An unprotected database is an unprotected database whether the company behind it builds security tooling or a shopping cart. If anything, it's a useful gut-check: the checks a scanner runs against your infrastructure are worth running against your own.
The thread connecting all three
An endpoint that trusted a request it shouldn't have. A third-party integration nobody was still watching. A database that was simply reachable. None of these needed a sophisticated attacker, and none of them are unique to any one industry, including the one built specifically to prevent them.
Sources: BrightDefense on the ServiceNow ACL incident · The Hacker News on the Salesforce/Klue compromise · TechRadar Pro on the APIsec data exposure
Decloak's API Scanning discovers and safely tests REST, GraphQL, and SOAP endpoints for exactly this class of access-control gap, alongside seven other attack surfaces. Scan your site free →