A cybersecurity researcher found millions of files exposed in a database tied to CitySourced, a civic engagement platform used by local governments.
Acybersecurity researcher reported finding an exposed database tied to a civic engagement platform used by local governments that contained about 42 million documents and nearly 450,000 files with information collected by cities and their residents.
The researcher, Jeremiah Fowler, published a report on ExpressVPN on Thursday that claimed a publicly accessible database associated with CitySourced — a civic engagement platform now connected to the software and digital services company Granicus — exposed over 42 million documents and 450,000 JSON files containing personal information.
The database, Fowler said, was neither password-protected nor encrypted. The repository included personally identifiable information in plaintext, such as names, physical addresses, email addresses, phone numbers and thousands of other internal records dating from 2016 to 2026. It also contained images of complaints and code violation reports, as well as logs identifying the people who submitted them, including their names, addresses and details of their complaints, he said.
Fowler said after he notified CitySourced of the discovery, the database was restricted from public access. And after an inquiry from Fowler, Granicus responded that it was investigating the matter internally and was taking action.