Skip to content
CitySourced Exposes 42 Million Civic Records in Data Leak

CitySourced Exposes 42 Million Civic Records in Data Leak

First seen 29 Oct 2026, 21:14 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 22:16 UTC
  • •42 million civic records exposed, including sensitive PII.
  • •Database was unprotected, lacking both password and encryption.
  • •Incident highlights vulnerabilities in multi-tenant SaaS platforms.

A data leak involving CitySourced, a civic engagement platform, has exposed approximately 42 million documents and 450,000 JSON files containing personally identifiable information (PII) of residents across 184 locations in North America and the Caribbean. The unprotected database, discovered by cybersecurity researcher Jeremiah Fowler, lacked password protection and encryption, allowing public access to sensitive records dating from 2016 to 2026. The leaked data includes names, addresses, email addresses, and phone numbers of individuals who reported local issues. Fowler highlighted that the database appeared to be part of an operational application rather than a one-time data export. CitySourced, owned by Granicus, provides a platform for residents to report civic issues, and the incident has raised concerns about supply-chain vulnerabilities. Following the discovery, access to the database was restricted, and Granicus stated it is investigating the issue. The duration of the exposure and whether any unauthorized access occurred before the discovery remain unknown.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-29
Data leak discovered
Jeremiah Fowler uncovered a publicly exposed database linked to CitySourced, containing sensitive records.
ExpressVPN
2026-10-29
Public access restricted
Following the discovery, access to the exposed database was restricted by Granicus.
Cyberkendra

More articles in this cluster (3)

Following this threat?

Track CitySourced in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 3

Common questions

What type of data was exposed?
The exposed data included names, addresses, email addresses, and phone numbers of residents who reported civic issues.
How long was the database exposed?
The exact duration of the exposure is unknown, as is whether any unauthorized access occurred prior to the discovery.
What actions is Granicus taking?
Granicus is investigating the issue internally and has stated they are taking action to address the exposure.