Massive GovTech breach leaks 42 million documents, including thousands full of personal information
follow us
Add us as a preferred source on Google
- Investigator finds exposed database containing 42 million documents and hundreds of thousands of records with personal data
- The repository linked to CitySourced exposed names, contact details, complaint reports and internal records for years.
- Database was secured after disclosure, highlighting ongoing risks from misconfigured cloud storage
Millions of documents, many of which exposed personally identifiable information (PII), were online, in an open database accessible to anyone with a browser and the knowledge of where to look. The database belonged to a GovTech company called CitySourced and has since been locked.
Cybersecurity researcher Jeremiah Fowler reported finding a database containing approximately 42 million documents and 450,000 JSON files containing PII in plain text.
The exposed records consisted primarily of images of complaints or reports of code violations, but after analyzing a limited sample, Fowler discovered that the database contained people’s names, mailing addresses, email addresses, phone numbers and “thousands of internal records dating from 2016 to 2026.”
Latest videos ofTechnologyRadar
This type of information is a gold mine for cybercriminals. By knowing private information about their targets, they can create personalized phishing messages, increasing their chances of success. Data like this is frequently shared and sold on the dark web and is often used as leverage in ransomware negotiations.
CitySourced reacts
The exposed repository contained different top-level application directories, Fowler explained, listing names such as Api, Content, Clients, Data, Developers, FileStorage, json, Product, Public, Support, Widget, temp, Logs and others. The file also apparently contained several .sdk and .exe files, which are quite out of place and could indicate that someone tried to install malware.
The name of the database and the files it contains led Fowler to conclude that they belonged to an American company called CitySourced. It is an American civic technology company (GovTech) that develops software that residents can use to report local problems such as potholes or malfunctioning street lighting to municipal authorities. It was founded in 2009 and merged with Rock Solid Technologies in 2019. Three years later, the company was acquired by government technology provider Granicus.
In reporting on these databases, Fowler generally emphasizes that owning and operating are two different things, and that he could not determine whether an outside contractor managed them or not. Still, after contacting CitySourced, the company locked the database and thanked Fowler for his efforts:
“Thank you again for the responsible disclosure and following up,” CitySourced said. “Granicus has reviewed the information you provided, investigated the matter internally and is taking steps to address the issue.”
How to protect a database
Misconfigured databases remain one of the leading causes of data leaks. Some companies don’t know that they are responsible for the security of the data they create and instead believe it is the responsibility of their cloud provider. Others are simply unaware of the misconfiguration, leaving data widely available and risking reputational damage and even class action lawsuits.
Fowler says companies can protect their infrastructure by segmenting customer environments and internal data.
There is no reason for all eggs to be in one basket, so in the event of a compromise, configuration error, or unauthorized access involving a tenant, information belonging to other organizations remains safe.
“Storage systems, backups and sensitive data must be encrypted and protected against unauthorized access,” he added. “Tenant isolation, access controls and encryption provide a good first layer of defense that could limit the overall impact of a data security incident.”
People should assume that cybercriminals already know something about them. There have been so many leaks over the years that it’s almost impossible for anyone’s data to remain completely private, at least things like names and emails. Therefore, they should always approach incoming email with skepticism, especially unsolicited emails and those containing links, attachments, or highly urgent messages.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment