CitySourced Data Exposure Prompts Scrutiny of Local Government Vendor Security

Cybersecurity researcher Jeremiah Fowler reported finding a publicly accessible database associated with CitySourced, a civic engagement platform used by local governments and now connected to software and digital services company Granicus. Fowler’s report described more than 42 million documents and nearly 450,000 JSON files containing information collected by cities and residents. He said the repository was neither password-protected nor encrypted and included personally identifiable information in plaintext, including names, physical addresses, email addresses, and phone numbers. The records reportedly dated from 2016 to 2026.

The reported contents also included images of resident complaints and code violation reports, along with logs identifying people who submitted them and details of their complaints. Fowler said the database was restricted from public access after he notified CitySourced. Granicus told StateScoop that the issue described in the report was identified and fully resolved in August, that no passwords were in the repository, and that all affected customers were notified immediately. The company said it found no signs that another party accessed or attempted to access the data. The report did not establish how long the database was publicly accessible or identify the specific government customers and residents affected.

For local-government procurement teams, the report is a practical prompt to examine how civic technology platforms store, configure, and protect resident-submitted documents and records. Contract reviews and renewals can assess whether vendors use appropriate access controls and encryption, how they monitor for exposure, and whether security responsibilities are clearly allocated. Buyers should also verify that agreements spell out incident notification timelines, cooperation with customer investigations, remediation expectations, and support for any legally required notifications. These are relevant due-diligence questions rather than findings about the terms of any particular CitySourced contract.

Granicus did not answer StateScoop’s questions about what caused the database to be publicly accessible or what specific steps were taken to prevent a recurrence. The company said, “CitySourced continues to be supported, with revised permissions in place to ensure no public access.” A spokesperson also said Granicus monitors its systems around the clock and that its incident response team follows established procedures to contain, investigate, and remediate incidents, notifying users and applicable regulators in line with breach notification laws. The company’s statements provide context for buyer discussions, but agencies may still want to seek details relevant to their own deployments, controls, and contractual obligations. The report identifies no contract value, solicitation, award, or procurement deadline.

• Scale reported: Fowler described more than 42 million documents and nearly 450,000 JSON files in the exposed database.
• Data types: Reported contents included names, addresses, email addresses, phone numbers, complaint images, code violation reports, and submitter logs.
• Security condition: Fowler said the database was publicly accessible, not password-protected, and not encrypted; Granicus said no passwords were present in the repository.
• Company response: Granicus said the issue was fully resolved in August, customers involved were notified immediately, and it found no evidence of access or attempted access by another party.
• Unanswered details: The report did not specify the exposure period, affected government customers, number of impacted customers, or the cause of public accessibility.
• Platform reach: Fowler’s report cited online sources indicating CitySourced serves local governments in 38 U.S. states and Puerto Rico, as well as locations in Canada and the Caribbean.
• Procurement review: Buyers can examine vendor controls for stored records, access permissions, monitoring, incident response, and remediation, especially during renewals and new evaluations.
• Contract considerations: Confirm breach-notification duties, customer cooperation, remediation responsibilities, and applicable regulator-notification processes in relevant agreements.
• Market signal: The report does not identify a solicitation, contract value, procurement deadline, or a specific procurement action by any government customer.