Researcher finds exposed database containing 42 million documents and hundreds of thousands of records with personal data
The CitySourced-linked repository exposed names, contact details, complaint reports, and internal records for years
Database was secured after disclosure, highlighting ongoing risks from misconfigured cloud storage
Millions of documents, many exposing personally identifiable information (PII), were sitting online, in an open database accessible to anyone with a browser and the knowledge of where to look. The database belonged to a GovTech company called CitySourced, and has since been locked down. Cybersecurity researcher Jeremiah Fowler reported finding a database contained roughly 42 million documents and 450,000 JSON files containing PII in plaintext. The exposed records consisted primarily of images of complaints or code violation reports, but after analyzing a limited sample, Fowler found the database held people’s names, postal addresses, email addresses, phone numbers, and “thousands of internal records dating from 2016 to 2026”. This kind of information is a gold mine for cybercriminals. By knowing private information about their targets, they can create custom, personalized phishing messages, increasing their chances of success. Data like this is frequently shared and sold on the dark web, and is often used as leverage in ransomware negotiations. CitySourced reacts
The exposed repository contained different top-level application directories, Fowler explained, listing names such as Api, Content, Customers, Data, Developers, FileStorage, json, Product, Public, Support, Widget, temp, Logs, and others. Apparently, the archive also contained multiple . sdk and . exe files – which are quite out of place and could indicate that someone tried to plant malware. The name of the database and files inside led Fowler to conclude they belonged to a US company called CitySourced…