A cybersecurity researcher recently uncovered a publicly accessible database linked to CitySourced, a civic engagement platform utilized by various local governments, as reported by Statescoop.
Researcher Jeremiah Fowler identified an unsecured repository containing 42 million documents and 450,000 files. The database, which lacked password protection or encryption, exposed personally identifiable information including names, physical addresses, email addresses, and phone numbers. Records spanned from 2016 to 2026 and included images of code violation reports and citizen complaints. CitySourced, now owned by Granicus, reportedly restricted access after being notified of the vulnerability. A Granicus spokesperson stated the issue was resolved in August and noted that no passwords were contained within the repository.
The company claimed it found no evidence of unauthorized access by third parties and confirmed that affected customers were notified. While the total number of impacted entities remains undisclosed, the platform serves local governments across 38 U.S. states, Puerto Rico, Canada, and the Caribbean. Granicus emphasized that it maintains 24/7 monitoring and follows established incident response procedures to mitigate security threats. The company did not clarify the specific cause of the exposure or provide details on preventative measures implemented to avoid future occurrences.
Source: Statescoop
