42 million docs left unsecured: local complaints exposed personal data for years

People who used local government issue-reporting tools may have unknowingly exposed sensitive personal information, including names, home addresses, phone numbers, and email addresses. The database contained 42 million documents, a researcher has found.

In a new report, Jeremiah Fowler, a cybersecurity researcher, says he found an unprotected, unencrypted database linked to a civic engagement platform owned by Granicus.

The platform allows residents to report issues to local governments in about 184 locations across North and Central America. These issues include, for example, potholes, graffiti, broken streetlights, or sanitation problems, and they can be reported directly from mobile devices.

In the limited sample Fowler reviewed, the database held about 42 million documents, including 450,000 JSON files with plaintext names, addresses, email addresses, and phone numbers.

It primarily contained images of resident complaints and code violation reports, plus thousands of internal records dating from 2016 to 2026, Fowler said in his report, first shared with ExpressVPN.

“The exposed repository contained numerous top-level application directories, including names such as Api, Content, Customers, Data, Developers, FileStorage, json, Product, Public, Support, Widget, temp, Logs**, and several other operational folders. There were also a number of .sdk and .exe files,” wrote the researcher.

Public access already restricted

The name of the database and files contained within it indicated that the records belonged to an American company called CitySourced.

According to Fowler, though, it’s not clear whether the database was owned and managed directly by the company or by a third-party contractor.

Besides, CitySourced – a mobile civic engagement platform that provided services to local government agencies in approximately 184 unique geographic locations – is currently owned and operated by Granicus.

When Fowler alerted the company to the exposure of millions of records that were accessible to anyone with an internet connection, with no specialized tools needed to view them in a browser, the database was quickly restricted from public access and is now inaccessible.

It isn’t known how long the database had been publicly accessible before the researcher discovered it. It’s also unclear whether any unauthorized parties may have accessed the records.

Sensitive targets

Risks to both government services and residents exist. According to Fowler, local governments and contractors that provide citizen services are particularly sensitive targets

since a successful compromise can disrupt important services that residents depend on.

The broader concern is that threats to local governments and critical infrastructure aren’t limited to financially motivated cybercriminals.

“There is a growing trend of state-sponsored and state-affiliated ransomware groups targeting government services and infrastructure,” said Fowler.

According to a 2026 advisory by the Cybersecurity and Infrastructure Security Agency (CISA), there have been documented cases of actors affiliated with Iran’s Islamic Revolutionary Guard Corps compromising operational technology used by the US water and wastewater facilities.

Fowler is quick to stress that he’s not implying or claiming that any of CitySourced’s customers or users are at risk of these threats – these are just risk scenarios.

Risks to governments and residents

Still, he points out that organizations shouldn’t collect, store, and manage extensive customer-specific information in a single database.

That’s because this increases the risk of a single cloud security misconfiguration exposing

information belonging to multiple independent organizations simultaneously.

Segmenting customer environments and internal data can help ensure that if there is ever a compromise, configuration error, or unauthorized access involving one tenant, it does not allow access to information belonging to other organizations,

said cybersecurity researcher Jeremiah Fowler.

A good example is what happened in France this year. In August, a series of cyberattacks targeting French government systems exposed sensitive citizen and business data, including taxable income, withholding tax rates, property records, and other information affecting nearly 700,000 individuals and businesses.

Individuals who believe their information may have been exposed in any type of data breach

should be aware of common phishing and social engineering tactics.

These can include suspicious emails, phone calls, text messages, or other communications that reference past reports, account numbers, addresses, municipal requests, or other internal information.

“Criminals often use accurate personal or account-specific details to establish trust and

impersonate service providers or other organizations individuals have interacted with,” Fowler said.