[{"data":1,"prerenderedAt":128},["ShallowReactive",2],{"blog_post:unlocked-database-exposed-42-million-local-government-records":3},{"id":4,"uid":5,"url":6,"type":7,"href":8,"tags":9,"first_publication_date":10,"last_publication_date":10,"slugs":11,"linked_documents":13,"lang":14,"alternate_languages":15,"data":16},"avNOYREAACcAg1OQ","unlocked-database-exposed-42-million-local-government-records","\u002Fnews\u002Funlocked-database-exposed-42-million-local-government-records","blog_post","https:\u002F\u002Fairlift.cdn.prismic.io\u002Fapi\u002Fv2\u002Fdocuments\u002Fsearch?ref=avXtSRIAACcAKfmG&q=%5B%5B%3Ad+%3D+at%28document.id%2C+%22avNOYREAACcAg1OQ%22%29+%5D%5D",[],"2026-11-12T16:45:55+0000",[12],"an-unlocked-database-exposed-42-million-local-government-records.-no-hacker-required.",[],"en-us",[],{"post_title":17,"author":23,"category":28,"date":29,"summary":30,"hero_image":34,"body":46},[18],{"type":19,"text":20,"spans":21,"direction":22},"heading1","An Unlocked Database Exposed 42 Million Local Government Records. No Hacker Required.",[],"ltr",[24],{"type":25,"text":26,"spans":27,"direction":22},"paragraph","cloudPWR Team",[],"insights","2026-11-10",[31],{"type":25,"text":32,"spans":33,"direction":22},"A security researcher found 42 million resident records sitting in an unencrypted, password-free database tied to the CitySourced civic engagement platform. Here's why that's a design failure, not a hack, and what governed pipelines do differently.",[],{"dimensions":35,"alt":38,"copyright":39,"url":40,"id":41,"edit":42},{"width":36,"height":37},3999,2666,"Wooden scrabble tiles spelling DATA BREACH on a reflective surface","Photo by Markus Winkler via Pexels - free for commercial use","https:\u002F\u002Fimages.prismic.io\u002Fairlift\u002FmGOOcGm0_9Vmkkhq_hero-image.jpg?auto=format,compress","mGOOcGm0_9Vmkkhq",{"x":43,"y":43,"zoom":44,"background":45},0,1,"#ffffff",[47,85,96],{"variation":48,"version":49,"items":50,"primary":51,"id":82,"slice_type":83,"slice_label":84},"default","initial",[],{"body_text":52},[53,56,72,76,79],{"type":25,"text":54,"spans":55,"direction":22},"A security researcher didn't need to break into anything to find 42 million documents sitting exposed in a database tied to CitySourced, a civic engagement platform cities and counties use to collect code violation reports, service requests, and resident complaints. He just found it. No password. No encryption. Records going back to 2016.",[],{"type":25,"text":57,"spans":58,"direction":22},"Jeremiah Fowler, who publishes research through ExpressVPN, reported the exposed repository in early November. It held more than 450,000 JSON files containing plaintext personal information: names, home addresses, phone numbers, email addresses, plus photos submitted as evidence of code violations and the identifying details of the residents who filed them. CitySourced is now part of Granicus, which the report says serves local governments across 38 states, Puerto Rico, and parts of Canada and the Caribbean. Granicus told StateScoop the issue was found and fixed in August, and that no passwords were stored in the exposed data. It hasn't said how the database became publicly accessible, how long it was reachable before Fowler found it, or how many of its government customers were affected.",[59,67],{"start":60,"end":61,"type":62,"data":63},60,91,"hyperlink",{"link_type":64,"url":65,"target":66},"Web","https:\u002F\u002Fwww.expressvpn.com\u002Fresearch\u002Fcitysourced-data-exposed","_blank",{"start":68,"end":69,"type":62,"data":70},514,538,{"link_type":64,"url":71,"target":66},"https:\u002F\u002Fstatescoop.com\u002Freport-over-42-million-records-exposed-by-local-government-technology-platform-for-civic-engagement\u002F",{"type":73,"text":74,"spans":75,"direction":22},"heading3","This Wasn't a Breach in the Way Agencies Usually Picture One",[],{"type":25,"text":77,"spans":78,"direction":22},"There's no phishing email in this story. No stolen credentials, no ransomware note, no attacker to name. The database was just sitting there, reachable by anyone who found the address, for reasons Granicus still hasn't explained publicly. That's a harder problem for an IT director to budget against than a hacker, because most agency cybersecurity spending assumes someone is actively trying to get in: firewalls, intrusion detection, endpoint monitoring, phishing training. A misconfigured permission doesn't trip any of that. Nobody has to break a lock that was never closed, and nothing in a standard security stack is built to notice a door nobody locked.",[],{"type":25,"text":80,"spans":81,"direction":22},"The part that should bother procurement teams more than the headline number is the date range. Some of those records went back to 2016, a full decade before Fowler found them. A code violation complaint a resident filed ten years ago, with their name and home address attached, was still sitting in an unencrypted, publicly reachable database in 2026, long after anyone at the agency that collected it had a reason to think about it. Nobody had looked at it in years. Nobody was supposed to need to, until someone did.",[],"body_text$5e324645-6ebe-4fee-858f-510a9672d8e4","body_text",null,{"variation":48,"version":49,"items":86,"primary":87,"id":94,"slice_type":95,"slice_label":84},[],{"quote_copy":88,"quote_source":92,"quote_image":93},[89],{"type":25,"text":90,"spans":91,"direction":22},"A decade of resident complaints sat in a publicly readable database, not because someone broke in, but because nobody was watching the door.",[],[],{},"quote$5dc233f1-f17a-4475-b28f-90cd58bd3732","quote",{"variation":48,"version":49,"items":97,"primary":98,"id":127,"slice_type":83,"slice_label":84},[],{"body_text":99},[100,103,111,114,117,120],{"type":73,"text":101,"spans":102,"direction":22},"What a Governed Pipeline Actually Buys an Agency",[],{"type":25,"text":104,"spans":105,"direction":22},"Encryption and access control shouldn't be settings an administrator configures once at setup and never revisits. They work better as properties of how a pipeline is built in the first place, not as controls bolted on after the fact. AIRLIFT Connect moves documents and data through four stages: Capture, Transform, Deliver, and Observe. Data arrives already carrying the access rules and retention expectations attached to where it came from, instead of landing in an intermediate database that becomes nobody's job to monitor once the initial integration ships.",[106],{"start":107,"end":108,"type":62,"data":109},234,249,{"link_type":64,"url":110,"target":66},"https:\u002F\u002Fwww.airlift.app\u002Fconnect\u002F",{"type":25,"text":112,"spans":113,"direction":22},"The Observe stage matters here specifically because it closes the gap that let a CitySourced-style exposure go unnoticed for years. Every import gets tracked through queued, downloading, transforming, delivering, and completed states, with a full audit timeline attached to each one. A document doesn't just sit in storage waiting for someone to remember it exists. It moves through a pipeline with a record of who touched it and when, which makes a decade-old forgotten database a much harder thing to end up with by accident, and a much easier thing to catch if it ever starts to happen.",[],{"type":73,"text":115,"spans":116,"direction":22},"Questions to Ask Before the Next CitySourced",[],{"type":25,"text":118,"spans":119,"direction":22},"Agencies evaluating any platform that collects resident-submitted documents, forms, complaints, or applications should ask a few specific things the Granicus statement didn't answer. Is intermediate storage encrypted at rest, not just the production database a vendor points to in a sales demo? Who can query that storage, and is every access logged and reviewable? And what happens to a record after the request it supports is resolved: does it get archived under a documented retention policy, or does it just stay in a database nobody has a reason to open again until a researcher does it for them?",[],{"type":25,"text":121,"spans":122,"direction":22},"cloudPWR built AIRLIFT and AIRLIFT Connect around the idea that data existing somewhere and data being governed are two different things, and the gap between them is exactly where incidents like this one happen. If your agency runs a pipeline where resident-submitted records pass through any kind of intermediate storage before they reach their system of record, that's worth checking now, before someone else finds it for you.",[123],{"start":43,"end":124,"type":62,"data":125},22,{"link_type":64,"url":126,"target":66},"https:\u002F\u002Fwww.cloudpwr.com\u002Fcontact\u002F","body_text$88c0d689-6105-4a9c-abb0-7bce9ebd80df",1794503463916]