Report: Over 42 million records exposed by local government technology platform for civic engagement

A cybersecurity researcher reported finding an exposed database tied to a civic engagement platform used by local governments that contained about 42 million documents and nearly 450,000 files with information collected by cities and their residents.

The researcher, Jeremiah Fowler, published a report on ExpressVPN on Thursday that claimed a publicly accessible database associated with CitySourced — a civic engagement platform now connected to the software and digital services company Granicus — exposed over 42 million documents and 450,000 JSON files containing personal information. 

The database, Fowler said, was neither password-protected nor encrypted. The repository included personally identifiable information in plaintext, such as names, physical addresses, email addresses, phone numbers and thousands of other internal records dating from 2016 to 2026. It also contained images of complaints and code violation reports, as well as logs identifying the people who submitted them, including their names, addresses and details of their complaints, he said.

Fowler said after he notified CitySourced of the discovery, the database was restricted from public access. And after an inquiry from Fowler, Granicus responded that it was investigating the matter internally and was taking action. 

A spokesperson for Granicus told StateScoop on Thursday via email that the issue described in the report was identified and fully resolved in August, and no passwords were in the repository. The spokesperson also said all customers involved were notified immediately, and the company did not find any signs that any other party accessed or attempted to access the data.

Granicus did not respond to StateScoop’s question about what caused the database to be publicly accessible, or a question about what steps have been taken to prevent a recurrence. The spokesperson instead said: “CitySourced continues to be supported, with revised permissions in place to ensure no public access.”

Fowler’s report did not outline how long the database was publicly accessible, or which specific government customers and residents were affected. Granicus also declined to specify how many customers were impacted.

Although figures on CitySourced’s customer base have been inconsistent following its 2022 acquisition by Granicus and earlier mergers, Fowler’s report cites multiple online sources indicating that the platform serves local governments in 38 U.S. states and Puerto Rico, as well as locations in Canada and the Caribbean.

“Granicus monitors its systems 24/7 for security threats, anomalies and incidents, and our team is notified of alerts promptly so we can respond and mitigate any issues,” the spokesperson said. “In the event of a security incident, our dedicated incident response team follows established procedures to contain, investigate and remediate it. We notify users and applicable regulators in line with breach notification laws.”