GovTech Data Leak Exposes 42 Million Documents and Personal Info

A cybersecurity researcher uncovered a massive, publicly accessible database containing roughly 42 million documents and hundreds of thousands of personal records. The exposed repository, linked to civic technology company CitySourced, left sensitive data unprotected on the internet without password protection or authentication requirements.

Researcher Jeremiah Fowler discovered the misconfigured database, which held approximately 450,000 JSON files containing personally identifiable information stored in plaintext. The exposed records primarily consisted of images tied to public complaints or code violation reports. However, a deeper analysis revealed full names, postal addresses, email addresses, and phone numbers alongside thousands of internal records dating from 2016 to 2026.

The repository also contained multiple application directories and unexpected executable and SDK files, which Fowler noted could indicate an attempt to plant malware. CitySourced develops software utilized by local residents to report municipal problems such as potholes and broken streetlights. The company was founded in 2009, merged with Rock Solid Technologies in 2019, and was later acquired by government technology provider Granicus in 2022.

Following responsible disclosure by the researcher, CitySourced secured the database and confirmed that Granicus had investigated the matter internally. Misconfigured cloud storage remains a persistent vulnerability across the tech industry, often stemming from confusion over cloud security responsibilities or improper access controls. Experts recommend that organizations implement strict tenant isolation, data encryption, and regular configuration audits to prevent similar unauthorized exposures.