Reported an Issue to Your City Through CitySourced? Learn About Your Options After the October 2026 Data Exposure Report

On October 29, 2026, cybersecurity researcher Jeremiah Fowler reported that he had found a publicly accessible database linked to CitySourced, a civic engagement platform that lets residents report local issues such as potholes, graffiti, broken streetlights and code violations to their local government. CitySourced is owned by Granicus, a government technology company, and has been reported to serve local governments in 38 U.S. states and Puerto Rico. According to the researcher, the database was neither password-protected nor encrypted and held about 42 million documents, including roughly 450,000 files containing personal information. The exposed records reportedly included:

• Names of residents who submitted reports
• Home and physical addresses
• Email addresses and phone numbers
• Images of complaints and code violation reports, with details of the complaints

The records reportedly date from 2016 to 2026. A Granicus spokesperson told StateScoop that the issue was identified and fully resolved in August 2026, that no passwords were in the repository, that affected government customers were notified, and that the company found no sign that any other party accessed the data. Granicus has not said how many people or which local governments were affected, or how long the data was publicly accessible.

If you submitted a report to your local government through a CitySourced app or website, you can see if you may qualify to connect with an independent attorney.