Skip to content
42 Million Civic Records Exposed in CitySourced Data Leak

42 Million Civic Records Exposed in CitySourced Data Leak

First seen 29 Oct 2026, 21:14 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 30, 2026 at 09:16 UTC
  • •42 million civic records exposed due to unprotected database.
  • •Data included sensitive PII such as names and contact information.
  • •Granicus stated the issue was resolved, but details on public access duration remain unclear.

A cybersecurity researcher discovered an unprotected database linked to CitySourced, revealing 42 million documents and 450,000 JSON files containing personally identifiable information (PII) of residents across North America and the Caribbean. The exposed data included names, addresses, email addresses, and phone numbers of individuals who reported civic issues from 2016 to 2026. The database lacked password protection and encryption, raising significant privacy concerns. After the discovery, the database was restricted from public access, and Granicus, the parent company of CitySourced, stated it was investigating the incident. Granicus claimed that the issue had been resolved in August 2026 and that no passwords were stored in the repository. However, it remains unclear how long the database was publicly accessible or if it was accessed by unauthorized parties before being secured.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-29
Data leak reported by researcher
Jeremiah Fowler published findings on an exposed CitySourced database containing 42 million records.
Cyberkendra
2026-10-29
Granicus responds to data leak
Granicus confirmed the database issue was identified and resolved in August, stating no passwords were stored.
Statescoop
2026-10-30
ExpressVPN publishes detailed report
ExpressVPN shared Fowler's findings, highlighting the lack of security measures on the exposed database.
ExpressVPN

More articles in this cluster (4)

Following this threat?

Track CitySourced in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 3

Common questions

What type of information was exposed?
The exposed data included names, addresses, email addresses, phone numbers, and complaint details of residents.
How long was the database publicly accessible?
The articles do not specify the duration of public access to the database.
What actions did Granicus take after the discovery?
Granicus stated they investigated the issue and restricted public access to the database after being notified.