Approximately 42 million documents containing personally identifiable information (PII) in plaintext were found in an unsecured government-technology database, a researcher reported.
Jeremiah Fowler's discovery
Cybersecurity researcher Jeremiah Fowler located a publicly exposed database that had no password protection or encryption. Fowler notified the organization that held the data, beginning a chain of remediation that, according to the reporting, resulted in the repository being restricted.
What the exposed records contained
The exposed collection was largely made up of images tied to code-violation reports and complaints. Among those images and associated files were records containing a decade’s worth of names, physical addresses, email addresses and phone numbers stored in plaintext — meaning the PII was not encrypted. The repository also exposed several top-level application directories and other operational folders.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildCitySourced: who held the database
The database belongs to CitySourced, a U.S. organization that provides services to local government agencies in the United States, Canada and the Caribbean. The organization’s platform is used for local-government reporting and related operational functions; the exposed repository appeared to include both user-facing records and backend application content.
Why local government data is a distinct risk
Local government agencies are identified in the reporting as uniquely sensitive targets because a cyberattack or service disruption against them can cause significant downstream impact. Data tied to resident reports, contact details and operational folders can be both personally intrusive and materially disruptive to municipal services.
What this means for local governments, security teams, and residents
- Local governments: Municipal IT and procurement leaders using third-party platforms will need to evaluate whether similar services they rely on expose operational directories or plaintext PII, because the CitySourced repository included both resident-facing reports and application-level folders.
- Technologists and security teams: Security personnel should note that the exposed database had no password protection or encryption; that combination is a straightforward misconfiguration vector that can lead to mass exposure of records, as seen in this instance.
- Residents and end users: Individuals whose names, addresses, emails or phone numbers appear in legacy records face the immediate confidentiality risk of that contact information being discoverable in bulk; the reporting indicates the dataset spanned roughly ten years of records.
Remediation taken and questions that remain
After Fowler alerted CitySourced, the reported response was to restrict access to the database; it is no longer accessible as of current publication. The reporting, however, does not establish how long the database had been publicly accessible before it was secured. That gap — the length of time the repository remained exposed — leaves an open question about whether any third party accessed or copied the files while they were unprotected.
The exposure combines a very large record count with unencrypted PII and operational folders that could aid an attacker’s understanding of an application’s structure. The immediate technical fix reported — restricting the database — addresses visibility, but the underlying facts reported here leave unanswered how long the data was available and whether any downstream actors retrieved it.
Source: SecurityMagazine — 42M Records Exposed by Government Technology Platform
