CitySourced Data Exposure Leaks 42M Civic Records

An unprotected database linked to CitySourced, the civic issue-reporting platform owned by government software provider Granicus, left 42 million documents and 450,000 JSON files open to anyone with a web browser, according to a report published by security researcher Jeremiah Fowler with ExpressVPN. The files were mostly images of resident complaints and code violation reports.

They included names, addresses, email addresses and phone numbers belonging to people who reported problems to local governments in roughly 184 locations across North America and the Caribbean.

CitySourced runs a 311-style service, the non-emergency request system that cities use to take reports from residents. People file issues through web and mobile apps, often with photos and location data, and the reports go into a case-management system used by municipal staff. Fowler said the database had no password and no encryption. In the limited sample he reviewed, records dated from 2016 through 2026.

The exposed storage looked like the inside of a running application, not a one-off data export. Fowler listed top-level directories named Api, Content, Customers, Data, Developers, FileStorage, Logs, Support and Widget, among other operational folders, along with a number of .sdk and .exe files. One of his screenshots shows an XML file with fields for username, password and email. The report does not say whether any passwords were stored in readable form or hashed.

Complaint Logs Tied Residents To Their Reports

Two of Fowler’s screenshots show complaint logs and citizen submissions. They list the resident’s name, phone number and email address to the address and details of the issue reported. A code violation report usually concerns someone else’s property, so in a record like this the person who complained is identified alongside the place they complained .

According to sources Fowler cites, the platform serves local agencies in 38 US states and Puerto Rico, in Alberta, British Columbia, Newfoundland and Labrador, Ontario and Saskatchewan in Canada, and in the Bahamas and Bermuda. CitySourced merged with Rock Solid Technologies in April 2019.

Granicus acquired Rock Solid in October 2022 and added its 311 and citizen engagement products to its government communications platform. Fowler said it is not known whether CitySourced ran the database itself or a third-party contractor managed it.

Fowler sent a responsible disclosure notice, and public access to the database was restricted soon afterwards. He received a saying Granicus had investigated internally and “is taking action to address the issue.” It is not known how long the files were public or whether anyone else accessed them before Fowler did. He said only an internal forensic review could answer that. Fowler said he does not download the data he finds and reviews only enough records to confirm an exposure.

One Platform, Many Municipalities

Fowler described the incident as a supply-chain problem. When a multi-tenant SaaS platform, meaning one shared software stack serving many separate customers, keeps data for all of them together, one cloud misconfiguration can expose records from many independent organisations at the same time. He recommended separating each customer’s environment and encrypting storage and backups so that a mistake affecting one tenant cannot expose the others. He also cited CISA advisories on attacks against government services and water utilities, while stating he makes no claim that CitySourced’s customers face those threats.

Residents who have filed reports through a CitySourced-powered app should be cautious emails, calls or texts that mention a past municipal request, a case number or their address. Scammers use accurate details like these to pose as a city office or service provider. Any request for passwords, verification codes or payment details should be checked through the council’s official website or phone line.

This is not the first exposed Granicus system. In February 2020, researcher Dan Ehrlich found a Granicus Elasticsearch cluster that had been open for at least five months, BankInfoSecurity reported . That cluster held links to files from more than 1,700 customers, which Granicus said pointed only to public, non-sensitive data. It predates the Rock Solid acquisition and involved a different product.

Several questions remain open. Granicus has not said how long the CitySourced files were exposed, whether its access logs show downloads by third parties, or whether it will notify the municipalities and residents whose records were in the database. The ExpressVPN report also does not give the date Fowler first found the exposure.

Join the conversation. Ask questions, solutions, and help others.

Be the first to start the discussion!