42M records, including PII, exposed in GovTech platform data breach
Cybersecurity Researcher Jeremiah Fowler uncovered a data leak involving millions of records containing personally identifiable information (PII) and shared his findings with ExpressVPN. The records belonged to a civic engagement software platform that lets residents report issues directly to local government agencies in over 180 geographic locations in North America and the Caribbean. We are publishing his report to help the public stay informed and protected as part of our ongoing effort to make the web a safer place.
Discovery of the exposed database
I recently discovered a publicly exposed database that was neither password-protected nor encrypted. The database contained approximately 42 million documents and 450,000 JSON files containing plaintext PII. The exposed records consisted primarily of images of complaints or code violation reports. In a limited sample of the records I reviewed as part of the investigation, I observed names, physical addresses, email addresses, phone numbers, and thousands of internal records dating from 2016 to 2026.
The exposed repository contained numerous top-level application directories, including names such as Api, Content, Customers, Data, Developers, FileStorage, json, Product, Public, Support, Widget, temp, Logs**, and several other operational folders. There were also a number of .sdk and .exe files.
The name of the database and files contained within it indicated that the records belonged to a U.S. company called CitySourced. However, it is not known whether the database was owned and managed directly by the company or by a third-party contractor. According to online sources, CitySourced provides services to local government agencies in approximately 184 unique geographic locations. These include 38 U.S. states and Puerto Rico; Alberta, British Columbia, Newfoundland and Labrador, Ontario, and Saskatchewan in Canada; and the Bahamas and Bermuda in the Caribbean.
I immediately sent a responsible disclosure notice to CitySourced, alerting them to the exposure of millions of records that were accessible to anyone with an internet connection, with no specialized tools needed to view them in a browser. The database was quickly restricted from public access and is no longer accessible at the time of publication. I received a reply stating, "Thank you again for the responsible disclosure and for following up. Granicus has reviewed the information you provided, investigated the matter internally, and is taking action to address the issue."
According to Wikipedia; "CitySourced is a civic engagement SaaS (Software as a Service) platform that connects citizens to local government agencies and the services they provide. The platform provides HTML5 and iOS/Android citizen-facing client applications that connect with a CRM and Service Request Management application tailored specifically for use within the public sector."
CitySourced merged with Rock Solid Technologies in April 2019, and Granicus acquired Rock Solid Technologies in October 2022. The acquisition combined Rock Solid's local government technologies, including its 311 non-emergency service request management and citizen engagement products, with Granicus's broader government communications and digital services platforms.
It is not known how long the database had been publicly accessible before I discovered it, nor whether any unauthorized parties may have accessed the records. Only an internal forensic investigation could determine whether additional access occurred or whether the data was downloaded by third parties.
What information was exposed?
This screenshot shows an XML file that contains fields for username, password, email, and other PII.
This screenshot shows folder names in the publicly exposed database.
This screenshot shows complaint logs containing names, addresses, and details of the complaint.
This image shows two screenshots of citizen complaints submitted to local governments that include names, phone numbers, email addresses, and other details.
Potential risks to government services and residents
Local governments and contractors that provide citizen services are particularly sensitive targets because a successful compromise can disrupt important services residents depend on. The broader concern is that threats to local governments and critical infrastructure are not limited to financially motivated cybercriminals. There is a growing trend of state-sponsored and state-affiliated ransomware groups targeting government services and infrastructure. According to a 2026 advisory by the Cybersecurity and Infrastructure Security Agency (CISA), there have been documented cases of actors affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) compromising operational technology used by U.S. water and wastewater facilities.
In a joint cybersecurity advisory, CISA, the Federal Bureau of Investigation (FBI), Multi-State Information Sharing and Analysis Center (MS-ISAC), and Department of Health and Human Services (HHS) warned that RansomHub had encrypted and exfiltrated data from at least 210 victims across the water and wastewater, information technology, government services and facilities, healthcare and public health, emergency services, food and agriculture, financial services, commercial facilities, critical manufacturing, transportation, and communications critical infrastructure sectors.
I am not implying or claiming that any of CitySourced’s customers or users are at risk of these threats. I am only identifying real-world risk scenarios associated with the potential threats to government services and infrastructure. My research is aimed at raising awareness and promoting data security, and I make no claims that the exposed data was ever at imminent risk.
How organizations and individuals can reduce their risks
Organizations that collect, store, and manage extensive customer-specific information in a single database raise potential supply chain concerns. Any multi-tenant SaaS platform or system where one shared set of software, infrastructure, or hardware serves many different customers could increase the risk of a single cloud security misconfiguration exposing information belonging to multiple independent organizations simultaneously. Segmenting customer environments and internal data can help ensure that if there is ever a compromise, configuration error, or unauthorized access involving one tenant, it does not allow access to information belonging to other organizations. Storage systems, backups, and sensitive data should be encrypted and protected against unauthorized access. Tenant isolation, access controls, and encryption provide a good first layer of defense that could limit the overall impact of a data security incident.
Individuals who believe their information may have been exposed in any type of data breach should be aware of common phishing and social engineering tactics. These can include suspicious emails, phone calls, text messages, or other communications that reference past reports, account numbers, addresses, municipal requests, or other internal information. Criminals often use accurate personal or account-specific details to establish trust and impersonate service providers or other organizations individuals have interacted with. Only communicate through official channels and verify that anyone requesting personal information is who they say they are. Never provide passwords, verification codes, financial information, Social Security numbers, or other sensitive data without first confirming that the request is legitimate.
Final thoughts and recommendations
CitySourced provides a valuable service designed to reduce the administrative costs and challenges associated with logging and processing large volumes of phone calls, emails, and citizen reporting. The service also allows residents to actively participate by providing government agencies with real-time, location-based information, including pictures, that helps municipalities respond more quickly to concerns or local infrastructure problems. This helps improve efficiency and transparency while encouraging greater citizen participation.
This incident serves as an important reminder that cloud security extends far beyond preventing external attacks. In many cases, the biggest risk comes from simple configuration errors that unintentionally expose internal resources and data to the public internet. As organizations increasingly rely on cloud infrastructure to support critical government services, continuous visibility into internet-facing assets and proactive security assessments remain essential components of protecting both customer data and public trust. Organizations responding to similar incidents should conduct internal forensic reviews, determine exactly what information was accessible, notify potentially affected individuals, reset credentials, and review access logs.
In August 2026, a series of cyberattacks targeting French government systems exposed sensitive citizen and business data, including taxable income, withholding tax rates, property records, and other information affecting nearly 700,000 individuals and businesses. This is another example of how data incidents or compromises involving public-sector systems can expose highly sensitive citizen data and create long-term risks.
As an ethical security researcher, I do not download the data I discover. I only review a limited number of records necessary to verify the exposure and responsibly notify the relevant parties. I do not conduct any activities beyond identifying the vulnerability and documenting the findings.
I imply no wrongdoing by CitySourced, Rock Solid Technologies, Granicus, or any related entities, contractors, or affiliates. I do not claim that any customer or user data was actively exploited or that any internal systems were compromised. The hypothetical risk scenarios presented in this report are provided strictly for educational and awareness purposes and should not be interpreted as evidence of malicious activity. I publish my findings to raise awareness about data privacy and security issues and to encourage organizations to proactively safeguard cloud storage repositories, sensitive internal information, and other PII.
