CitySourced data leak exposes 42 million documents due to cloud misconfiguration

What was exposed

Cybersecurity researcher Jeremiah Fowler discovered an unsecured database linked to GovTech company CitySourced, containing 42 million documents and 450,000 JSON files. The exposed records included personally identifiable information (PII) such as names, postal and email addresses, phone numbers, and thousands of internal records spanning from 2016 to 2026. The repository also featured top-level application directories like Api, Content, Customers, and Logs, alongside unusual files such as .sdk and .exe, raising concerns about potential malware infiltration.

According to TechRadar, the exposure underscores the risks of misconfigured cloud storage, which remains a leading cause of data leaks. Businesses often overlook their responsibility to secure data in cloud environments, leaving sensitive information vulnerable to cybercriminals.

Who is CitySourced

CitySourced is a US-based GovTech company founded in 2009, specializing in civic technology software. Its platform allows residents to report local issues like potholes or malfunctioning streetlights to municipal authorities. The company merged with Rock Solid Technologies in 2019 and was later acquired by Granicus, a government technology provider, in 2022.

CitySourced secured the exposed database after Fowler reported the issue and publicly acknowledged his responsible disclosure.

Why this matters for cybersecurity

The breach highlights how cybercriminals can exploit exposed PII to craft targeted phishing attacks, ransomware campaigns, or malware distribution. The presence of .exe and .sdk files in the exposed repository suggests potential malicious activity, emphasizing the need for robust security practices in cloud storage.

Misconfigured databases are a recurring issue, often resulting from businesses failing to implement proper access controls or segment customer data from internal systems. This incident serves as a reminder for companies to audit their cloud infrastructure and enforce security protocols to prevent similar leaks.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

For founders and operators, this incident is a stark reminder of the fragility of cloud-based data storage. Many businesses assume cloud providers handle all security measures, but the shared responsibility model means companies must actively manage access controls, encrypt sensitive data, and regularly audit their infrastructure. The exposure of application directories and executable files in this case also raises red flags about potential supply-chain attacks, where malware could be introduced into a company’s software ecosystem.

GovTech firms, in particular, handle sensitive civic data, making them prime targets for cybercriminals. This breach could erode public trust in digital civic engagement tools, potentially slowing adoption of similar platforms. Startups in this sector—or any industry relying on cloud storage—should treat this as a cautionary tale: invest in security training, automate configuration checks, and isolate critical systems to limit the fallout from inevitable human errors.

Related on Lazyfounder

• More technology news