An unlocked online database tied to CitySourced held about 42 million documents, including names, home addresses and phone numbers of residents who had reported potholes, broken streetlights and code violations to their cities. The CitySourced data breach matters because the people in that database never chose a data vendor. They only wanted a local problem fixed. Granicus, which owns CitySourced, has since restricted public access to the database.
Jeremiah Fowler, a cybersecurity researcher who works with Black Hills Information Security, found the open database. He published his findings through ExpressVPN's research team. The database had no password and no encryption, and Fowler linked it to CitySourced based on its file and folder names.
CitySourced is a civic platform where residents submit reports to municipal authorities. According to Mezha, CitySourced merged with Rock Solid Technologies in 2019, and Granicus acquired the company in 2022. Public reporting on the exposure appeared on October 29 and 30, 2026, when Mallory published its account and TechRadar followed on October 30.
What the CitySourced data breach exposed
The database held about 42 million documents. Roughly 450,000 of them were JSON files that contained personal information in plaintext, which means anyone who opened them could read it without decryption. The reporting describes these categories:
- Names, home addresses, email addresses and phone numbers
- Complaint photos and code-violation reports
- Internal company files dating from 2016 to 2026
- Some .sdk and .exe files, whose purpose is not yet clear
The .sdk and .exe files deserve a closer look. TechRadar noted they could indicate someone tried to plant malware, but that claim is unconfirmed, and no published source says it happened. For now, the files are an open question rather than a finding.
The 42 million figure counts documents, not people, a point that Digital Reviews makes directly. One resident can appear in several documents, so the number of affected people is unknown and may be far lower than the document count.
Which cities and residents may be affected
CitySourced serves roughly 184 geographic locations, according to online sources that ExpressVPN cites. Those sources do not say which of those places are tied to the exposed database. No published account names the affected cities or gives a count of actual residents.
Residents of cities served by CitySourced may not know their city's vendor was involved. Many people report a pothole through a city website or a phone line and never see the name of the company behind the tool. That gap leaves them unable to judge their own exposure.
Public bodies remain attractive targets. The Oneonta city school district ransomware case shows how quickly a local public system can go dark, although that incident was a different kind of attack than this one.
Why the database stayed open and who is responsible
Misconfigured cloud storage is a recurring cause of exposures like this one, and TechRadar framed the CitySourced incident that way. A database left reachable without a password is usually a configuration problem, not a sophisticated break-in, which is part of why these leaks keep happening.
Civic reporting tools collect more than the complaint itself. A report may include an address so a crew can find the spot, a phone number for follow-up, and a photo of the property. Each field helps the city do its job, and each one also helps a scammer write a convincing message.
The central unanswered question is who operated the server. Fowler could not determine whether CitySourced itself or a third-party contractor ran the database. That answer decides which company must explain the exposure and who would send any notices to residents.
CitySourced thanked the researcher for responsible disclosure. The company said, “Thank you again for the responsible disclosure and for following up,” as reported. Granicus restricted public access after being alerted, but nothing in the sources shows how long the files were reachable or whether anyone besides the researcher viewed or copied them.
Fowler offered a measured view. “I make no claims that the exposed data was ever at imminent risk,” he said. That statement cuts against alarm, but it does not change what the files contained or who could have reached them while the server was open.
The timeline also conflicts across sources. Digital Reviews says Fowler first notified the organization on July 14, 2026, which does not match the October 29 reporting date in Mallory's account. Until the company or the researcher clarifies that gap, the exposure window stays uncertain.
How to protect yourself after the CitySourced data breach
No confirmed misuse of the data has been reported, but the exposed contact details could fuel targeted phishing. These steps cost little and reduce the risk.
- Find out whether your city uses CitySourced or Granicus tools. Check your city's website for a 311 or report-a-problem app, or call the public works office and ask which vendor runs it.
- Treat unexpected emails, texts or calls that mention a local complaint or report as possible phishing. Do not click links in them. Go to your city's official website on your own.
- Ask your city or the vendor whether they will send a breach notice, and what information they hold about you.
- Be wary of messages that cite a pothole, streetlight or code violation you never reported. Scammers can use real local details to sound credible.
What comes next for Granicus and affected cities
Scammers stand to gain the most from an exposure like this, since a real phone number and a plausible local reason to call make a convincing lure. Cities that work with the vendor now face questions from residents who want to know what was stored about them.
Several questions will decide how serious this becomes. Whether state breach-notification laws apply, and whether Granicus will issue formal notices, is not confirmed in the reporting so far.
Formal filings usually produce firmer numbers than early reports. In a separate healthcare case, the iRhythm breach now appears at 8.2 million people on the HHS breach portal, which shows what a formal count looks like once it is filed.
Watch for three things: a list of affected cities, a count of actual residents rather than documents, and a public explanation of who ran the server and what the .sdk and .exe files were. Residents of CitySourced cities should assume their contact details are out there and read unexpected messages with extra suspicion.
