A significant data breach involving a US government technology company has been identified after cybersecurity researcher Jeremiah Fowler discovered an open database accessible to anyone with a web browser. The exposed repository, linked to CitySourced, contained approximately 42 million documents and 450,000 JSON files holding personally identifiable information (PII) in plaintext. While the records primarily consisted of images related to complaints or code violation reports, analysis revealed they also included individuals' names, postal addresses, email addresses, and phone numbers.
The database held thousands of internal records dating from 2016 to 2026, presenting a substantial risk as such data is often utilized by cybercriminals for targeted phishing campaigns or sold on the dark web. Fowler noted that the repository contained various application directories, including Api, Customers, and FileStorage, alongside multiple .sdk and .exe files that appeared out of place and could suggest an attempt to plant malware. CitySourced, founded in 2009 and later acquired by Granicus after merging with Rock Solid Technologies, develops software allowing residents to report local issues like potholes or malfunctioning streetlights to municipal authorities.
Upon notification of the vulnerability, CitySourced secured the database and acknowledged the researcher's efforts. A statement from the company indicated that Granicus had reviewed the provided information, conducted an internal investigation, and was taking action to address the issue. Fowler emphasized that while he could not determine if a third-party contractor managed the infrastructure, the incident highlights the ongoing risks associated with misconfigured cloud storage.
The breach underscores the prevalence of data leaks caused by configuration errors, where businesses may mistakenly assume their cloud providers are solely responsible for security or remain unaware of exposed data. To mitigate such risks, Fowler recommends that organizations segment customer environments and internal data to ensure tenant isolation. He further advised that storage systems, backups, and sensitive data must be encrypted and protected against unauthorized access through robust access controls. For individuals, the researcher suggested maintaining skepticism toward unsolicited emails containing links or attachments, given the likelihood that personal data has already been compromised in past breaches.
Sources: TechRadar.