CitySourced Data Exposure Leaks 42M Civic Records
CitySourced database exposed 42M civic records including PII.
An unprotected CitySourced database, owned by Granicus, exposed approximately 42 million civic records. The data included names, addresses, and phone numbers from resident complaints and code violation reports across North America and the Caribbean. The database lacked password protection and encryption, potentially allowing unauthorized access to sensitive personal information.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Granicus?
Get an email when a new story names Granicus, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCitySourced, operated by Granicus, left a database containing approximately 42 million civic records publicly accessible without password protection or encryption — a fundamental configuration failure. This exposed sensitive personal information including names, addresses, and phone numbers of residents who had interacted with government complaint and code violation systems. The breach highlights that organizations handling civic data must apply the same rigorous security baseline to every data store, not just high-profile systems. When a vendor or SaaS provider manages government data, any misconfiguration becomes a public trust issue with significant regulatory implications.
What helps against this
How we list vendors- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.