An exposed database tied to U.S. civic-technology company CitySourced contained roughly 42 million documents and about 450,000 JSON files with personal information, according to cybersecurity researcher Jeremiah Fowler and reporting by TechRadar. The repository was accessible online before it was secured after the disclosure.
CitySourced develops software that residents use to report local issues, including potholes and broken streetlights, to municipal authorities. The exposed material consisted mainly of images connected to complaints or code-violation reports. Fowler said a review of a limited sample found names, postal addresses, email addresses and phone numbers in the database.
“thousands of internal records dating from 2016 to 2026”
Fowler used that phrase to describe additional records found in the repository. The information was stored in plain text in some of the files, according to the report. The database also included directories associated with applications, customer information, data storage, support and logs.
What the exposed records contained
| Information reported | Details |
|---|---|
| Documents | Roughly 42 million |
| JSON files | About 450,000 containing personal information |
| Personal data | Names, postal addresses, email addresses and phone numbers |
| Record period | Records dating from 2016 to 2026 |
Personal information in complaint reports can give criminals details they may use to tailor phishing messages, TechRadar reported. Phishing is a scam in which an attacker impersonates a trusted person or organization to persuade someone to disclose information or take another action. The report also said exposed data can be shared or sold in criminal marketplaces or used as leverage in ransomware operations, although no misuse of the CitySourced data was reported.
Fowler identified the company from the database name and the files it contained. The repository included several application directories and files with extensions such as .sdk and .exe. Fowler said some of those files appeared out of place and could indicate an attempt to plant malware, but the report did not establish that the files had harmed users.
Repository was secured after disclosure
The database has since been locked down, highlighting the risk created when cloud storage is left open to anyone who knows where to find it. The incident involved information connected to CitySourced's civic-reporting platform, rather than a reported compromise of a credit bureau, bank or payment-card system. The published account did not provide a number of affected individuals, identify specific municipalities or say whether CitySourced had notified people whose information appeared in the records.
- About 42 million documents were reportedly exposed online.
- About 450,000 files contained personal information in plain text.
- The repository was secured after researcher Jeremiah Fowler disclosed the exposure.
The incident illustrates how information collected for routine municipal complaints can create privacy and identity-theft risks when it is stored in a publicly accessible system. Names and contact details alone do not establish that fraud occurred, but they can help scammers make messages appear more credible. The reported exposure also covered records accumulated over several years, increasing the amount of historical information available in the database.
