ServiceNow Discloses Customer Data Query Incident: What Was Reportedly Exposed & What To Do

On June 9, 2026, ServiceNow disclosed that attackers had exploited an unauthenticated API endpoint to query data from certain customer instances. The company stated that it deployed a fix on June 5, notified affected customers, and recommended review of logs for specific indicators of suspicious activity. The number of people or organizations impacted remains unknown, and no further technical details about the scope or duration of access have been released publicly.

Breaking down the breach

ServiceNow reported that the incident allowed external parties to retrieve information stored within selected customer instances on its platform. The affected data types explicitly referenced include customer instance data, IT support tickets, and employee records. No figures have been provided on the volume of records accessed or the number of instances involved. The company limited its public statement to confirmation of the flaw, the date of remediation, and guidance for customers to examine their own logs.

How a breach like this happens

Incidents involving unauthenticated API endpoints typically occur when a service exposes a function that accepts queries without requiring prior authentication or proper authorization checks. An attacker who discovers or enumerates such an endpoint can issue requests that return structured data directly from backend systems. Once the endpoint is identified, automated tools can be used to iterate through parameters and extract records at scale. Organizations often detect these issues only after monitoring systems flag anomalous query patterns or after external reports surface.

Who is ServiceNow?

ServiceNow provides a cloud platform used by enterprises to manage IT service workflows, incident tracking, and internal support processes. Its instances commonly store configuration items, ticket histories, user directories, and operational records tied to an organization’s technology environment. Because the platform sits at the center of many companies’ internal operations, exposure of instance data can surface details about both technical infrastructure and personnel.

What was likely exposed

The disclosure names customer instance data, IT support tickets, and employee records as the categories that could be queried. No additional data types have been confirmed. Organizations that use ServiceNow instances routinely hold ticket contents that reference internal systems, user accounts, and support interactions; however, the precise fields or volume of records accessed in this case have not been disclosed.

Why it matters

Support tickets and employee records can contain identifiers, contact details, and contextual information about an organization’s operations and staff. When such data leaves the intended environment, it may be used for targeted follow-on activity such as social engineering or further reconnaissance. For ServiceNow customers, the incident underscores the risk that even limited API access can surface operational records that are normally restricted to authenticated users within each tenant.

What to do if you're exposed

Customers who received notification from ServiceNow should follow the company’s instructions to review logs for the specified activity patterns and apply any recommended configuration changes. Individuals concerned about their information should monitor accounts referenced in support tickets for unusual activity and consider enabling additional verification steps where available. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances in public records.

AICompiled with AI assistance from public sources and published under our editorial standards.