A publicly accessible database linked to CitySourced, a U.S.-based civic engagement platform, exposed approximately 42 million documents and 450,000 JSON files containing sensitive personal information, according to a security researcher who discovered the misconfigured repository.
The exposed database was neither password-protected nor encrypted, allowing anyone with an internet connection to access its contents through a web browser without specialized tools. The records primarily consisted of images of citizen complaints and code violation reports submitted to local government agencies.
During a limited review of the exposed files, the researcher found names, physical addresses, email addresses, phone numbers, and thousands of internal records dating from 2016 to 2026. Some XML files also contained fields for usernames, passwords, email addresses, and other personally identifiable information.
The repository included numerous application directories, including Api, Content, Customers, Data, Developers, FileStorage, Product, Public, Support, Widget, and Logs, alongside several executable and SDK files.
The database and its contents indicated a connection to CitySourced, a platform that provides digital tools for citizens to report local issues and communicate with government agencies. However, it remains unclear whether CitySourced directly owned and managed the exposed database or whether it was operated by a third-party contractor.
CitySourced reportedly serves local government agencies across approximately 184 geographic locations, including 38 U.S. states, Puerto Rico, several Canadian provinces, the Bahamas, and Bermuda.
Following the discovery, the researcher sent a responsible disclosure notification to CitySourced, informing the company that millions of records were publicly accessible. The database was subsequently restricted and was no longer accessible at the time of publication.
The researcher received a response stating that Granicus had reviewed the information, investigated the matter internally, and was taking action to address the issue.
CitySourced merged with Rock Solid Technologies in April 2019, while Granicus acquired Rock Solid Technologies in October 2022. The acquisition brought Rock Solid’s local government technology products, including its 311 service request management and citizen engagement solutions, into Granicus’s broader government technology platform.
It remains unknown how long the database was publicly accessible or whether unauthorized individuals accessed or downloaded the exposed information. Determining whether any third parties obtained the records would require an internal forensic investigation.
The exposure raises concerns about the security of platforms that collect and store large volumes of information submitted by residents to local government agencies. Such information can contain personal details, photographs, addresses, and descriptions of complaints that residents may not expect to become publicly accessible.
Although there is no evidence presented that the exposed information was exploited, publicly available personal details can create opportunities for phishing and social engineering attacks. Criminals may use information from previous municipal complaints, addresses, or service requests to make fraudulent emails, phone calls, and text messages appear legitimate.
Organizations operating multi-tenant software platforms also face additional security challenges. A single cloud storage misconfiguration could potentially expose information belonging to multiple independent government agencies and their residents.
Security researchers recommend implementing strong access controls, encryption, and tenant isolation to reduce the impact of configuration errors or unauthorized access. Organizations should also regularly assess internet-facing storage systems, backups, and internal repositories to identify resources that may have been unintentionally exposed.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
For individuals who believe their information may have been affected, caution is advised when receiving unexpected communications referencing municipal requests or personal details. Residents should verify requests through official channels and avoid sharing passwords, verification codes, or financial information with unverified contacts.
