CitySourced Data Breach Exposes 42 Million Documents, Raising Privacy Concerns

Published: October 30, 2026

A major data security incident has raised serious concerns about digital privacy after an unsecured database connected to CitySourced, a US-based government services platform, reportedly exposed approximately 42 million documents and 450,000 JSON files containing sensitive information.

The exposed records included personal details of residents who had submitted complaints and service requests to local government agencies. The discovery has highlighted the risks associated with storing large amounts of public information on online platforms without adequate security protections.

Millions of Documents Found in Unsecured Database

According to cybersecurity reporting, security researcher Jeremiah Fowler discovered a publicly accessible database that was not protected by a password or encryption.

The exposed repository reportedly contained around 42 million documents, including photographs of citizen complaints and reports concerning local code violations.

During a limited examination, the researcher identified names, physical addresses, email addresses and phone numbers. Some XML files also contained fields for usernames and passwords, raising additional concerns about the potential sensitivity of the information.

The records reportedly dated from 2016 to 2026.

CitySourced Platform Connection Raises Questions

CitySourced provides digital tools that allow residents to report neighbourhood problems and communicate with local government agencies.

The platform has reportedly served government agencies across approximately 184 geographic locations, including 38 US states, Puerto Rico, parts of Canada, the Bahamas and Bermuda.

However, it remains unclear whether CitySourced directly controlled the exposed database or whether a third-party contractor was responsible for managing it.

Database Restricted After Security Researcher's Warning

Following the discovery, the researcher reportedly contacted CitySourced through responsible disclosure procedures and informed the company about the exposed information.

The database was subsequently restricted and was no longer publicly accessible at the time of reporting.

The researcher also received a response indicating that Granicus had reviewed the information, investigated the incident internally and was taking action.

CitySourced merged with Rock Solid Technologies in 2019, while Granicus acquired Rock Solid Technologies in 2022.

Personal Information Could Create Cybersecurity Risks

The exposure has raised concerns about possible phishing and social engineering attacks.

Criminals could potentially use information such as residents' names, addresses and previous complaint details to create convincing fraudulent emails, phone calls or text messages.

However, there is currently no confirmed evidence that the exposed information was exploited or that unauthorized individuals downloaded the entire database.

It is also unknown how long the database remained accessible online.

What Should People Do to Protect Their Information?

People who have submitted complaints or service requests through local government platforms should remain alert to suspicious communications.

Cybersecurity experts recommend several precautions:

• Avoid clicking suspicious links in unexpected emails or text messages.

• Never share passwords or verification codes with unknown callers.

• Verify government-related requests through official contact channels.

• Use unique passwords for important online accounts.

• Enable two-factor authentication wherever available.

Conclusion

The CitySourced database exposure is another reminder that digital privacy depends on strong cybersecurity practices. The reported exposure of 42 million documents demonstrates how a security configuration mistake can potentially put residents' personal information at risk.

Although the database has reportedly been restricted, questions remain about how long the information was accessible and whether anyone obtained copies before access was blocked. Further investigation will be important in determining the full impact of the incident.