CitySourced Database Exposes 42 Million Documents, Including Residents’ Personal Data

A publicly accessible database associated with CitySourced, a civic engagement platform acquired by Granicus, exposed approximately 42 million documents and 450,000 JSON files without password protection or encryption. Cybersecurity researcher Jeremiah Fowler discovered the database, which predominantly contained images of code violation reports and complaints. Some records spanned a decade and included plaintext names, physical addresses, email addresses and phone numbers, potentially identifying residents who submitted reports to local governments.

CitySourced restricted public access after Fowler notified the organization. Granicus said the issue was fully resolved in August, affected customers were notified immediately, and it found no evidence of access or attempted access by other parties. The exposure’s duration, underlying cause, affected government agencies and number of impacted customers remain undisclosed. The incident highlights the need for government customers to verify vendors’ storage access controls and assess whether exposed complaint records could enable targeted phishing or compromise complainant privacy.