8 min read
Most people assume their biggest privacy risks come from social media or online shopping. Yet in late October 2026, cybersecurity researcher Jeremiah Fowler discovered something that reframes that assumption: a database containing roughly 42 million documents, including the names, home addresses, email addresses and phone numbers of ordinary residents, sitting online with no password and no encryption. The source was not a financial service or a tech giant—it was a civic engagement platform used by local government agencies to collect pothole reports, noise complaints and other everyday interactions between residents and their councils.
The platform in question is CitySourced, owned by government technology provider Granicus, which serves approximately 184 geographic locations across the United States. If you or someone you know has ever used a local council's app to report a broken streetlight or an abandoned vehicle, there is a reasonable chance that submission travelled through a system like this one. The breach illustrates something important: the data you share with public institutions is not automatically safer than the data you share with commercial companies—and the consequences of its exposure can be just as serious.
This article looks at what happened, why misconfigured cloud databases remain such a persistent problem, and what practical steps you can take to reduce the amount of personal information you leave behind when engaging with digital civic services.
What Fowler Found
Fowler's discovery, reported between 29 and 31 October 2026, centred on an unsecured, publicly accessible database linked to CitySourced. The figures are striking in their scale:
- Approximately 42 million documents exposed in total
- Around 450,000 JSON files containing plaintext personally identifiable information (PII)
- Data spanning a decade of records, from 2016 to 2026
- No password required—accessible to anyone with a browser who could locate the endpoint
- No encryption on the stored data
The information exposed included residents' full names, postal addresses, email addresses and phone numbers—everything submitted when a member of the public filed a civic complaint through a participating council's app. Internal records from across the platform's operational history were also present.
Granicus locked the database down after Fowler's responsible disclosure, and confirmed it had been publicly accessible. Crucially, the exposure period is unknown. There is no way to establish with certainty whether malicious actors found and harvested the data before Fowler did. That uncertainty alone is the defining feature of this kind of breach.
Why a Pothole Report Contains So Much Personal Data
It is worth pausing on what civic complaint platforms actually collect, because the category of data involved matters.
When a resident submits a report through a platform like CitySourced, they typically provide their name and contact details so the relevant council department can follow up. In many cases they also provide or confirm their home address, since the complaint is location-specific—a blocked drain outside your house, a cracked pavement near your front gate. The very nature of civic reporting ties personal identity to physical location.
That combination—name, home address, phone number and email—is precisely the dataset that enables phishing, smishing, physical targeting and identity fraud. Unlike a leaked email address in isolation, a full address-linked record gives an attacker a richer picture of who you are and where to find you. Multiply that by 42 million documents and you have a resource that would be genuinely useful to criminals operating at scale.
Misconfigured Databases: A Persistent and Preventable Problem
Fowler's discovery is not unusual in kind, only in scale. Misconfigured cloud storage—databases, object storage buckets and similar infrastructure left open to the public internet without authentication—has been the cause of numerous significant exposures over the past decade. The underlying pattern is consistent: a database is deployed, configured incorrectly or left in a testing state, and the error is not caught before it reaches production or is forgotten entirely.
Several factors make this problem persistent:
- Cloud defaults have historically been permissive. Many cloud services have, at various points, defaulted to public accessibility rather than private. Operators who do not actively review and harden configurations can find themselves exposed without realising it.
- Testing environments bleed into production. A database stood up quickly for development purposes, with authentication disabled for convenience, can end up containing real data if processes are not carefully controlled.
- Monitoring gaps are common. Without continuous scanning of an organisation's external attack surface, a misconfigured endpoint can remain open for months or years before anyone notices.
- GovTech procurement adds complexity. Local councils typically procure platforms from third-party vendors rather than building them in-house. Security responsibility can become unclear, with councils assuming vendors have hardened their infrastructure and vendors assuming councils have reviewed it.
The CitySourced case sits squarely within this pattern. A platform handling a decade's worth of civic data across nearly 200 locations apparently had no mechanism in place that would have detected or prevented anonymous public access to its database.
The GovTech Privacy Problem Is Structural
It would be tempting to treat this as an isolated incident—one vendor, one misconfiguration, quickly fixed. But the structural issue is broader. Local and regional government services have been steadily migrating to digital platforms, and residents are increasingly required or strongly encouraged to engage through apps and online portals. Reporting a pothole by phone or in person is often slower and less convenient than tapping through an app.
This creates a situation where residents provide personal data to intermediary technology platforms they have never heard of, whose security practices they have no visibility into, and whose contractual relationship is with the council rather than with them. The resident's mental model is
