[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJ1jPpQaJSjy5B88yNGFu7GRcJuusKAX5MXgD0mWbnXU":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"53148260-b0fe-4dd3-9311-31aa92c2c23b","CitySourced Data Exposure Leaks 42M Civic Records","citysourced-data-exposure-leaks-42m-civic-records-55dc66","A CitySourced database owned by Granicus exposed 42M records, including names, addresses and phone numbers from civic complaints.","An unprotected CitySourced database, owned by Granicus, exposed approximately 42 million civic records. The data included names, addresses, and phone numbers from resident complaints and code violation reports across North America and the Caribbean. The database lacked password protection and encryption, potentially allowing unauthorized access to sensitive personal information.","CitySourced database exposed 42M civic records including PII.","https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F10\u002Fcitysourced-data-exposure-leaks-42m-civic-records.html","https:\u002F\u002Fwww.cyberkendra.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FCitySourced.webp","2026-10-29T19:12:38+00:00","2026-10-29T21:00:09.381084+00:00",7,[17,20,23],{"name":18,"type":19},"CitySourced","product",{"name":21,"type":22},"Granicus","vendor",{"name":24,"type":25},"SaaS","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":26,"icon":28,"name":29,"slug":30},null,"Breaches","breaches",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[21,18],{"controls":52,"vendors":136},[53,81,110],{"slug":54,"name":55,"problem":56,"products":57},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[58,66,73],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":68,"url":71,"description":72},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":82,"name":83,"problem":84,"products":85},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"slug":111,"name":112,"problem":113,"products":114},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":132,"product_name":133,"url":134,"description":135},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":149},"42-million-civic-records-exposed-via-unprotected-database","42 Million Civic Records Exposed via Unprotected Database","CitySourced, operated by Granicus, left a database containing approximately 42 million civic records publicly accessible without password protection or encryption — a fundamental configuration failure. This exposed sensitive personal information including names, addresses, and phone numbers of residents who had interacted with government complaint and code violation systems. The breach highlights that organizations handling civic data must apply the same rigorous security baseline to every data store, not just high-profile systems. When a vendor or SaaS provider manages government data, any misconfiguration becomes a public trust issue with significant regulatory implications.",[142,143,144,145,146,147,148],"CIS Control 3: Data Protection","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","CIS Control 18: Penetration Testing","NIS2 Article 21(2)(b)",{"GDPR Article 32":150,"NIS2 Article 21(2)(b)":151,"CIS Control 3: Data Protection":152,"CIS Control 18: Penetration Testing":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":155,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":156},"Article 32 mandates that processors implement appropriate technical measures — including encryption and access controls — to protect personal data, both of which were missing in this incident.","NIS2 requires entities to implement incident handling and risk-appropriate security measures including access control; a civic data platform with no authentication fails this baseline obligation entirely.","This control requires organizations to inventory sensitive data and enforce encryption and access controls — both of which were entirely absent from the exposed CitySourced database.","Regular penetration testing or database exposure assessments would have discovered the publicly accessible, unauthenticated database before malicious actors could exploit it.","Failing to configure basic authentication and encryption represents an unaddressed flaw in the system's security posture that a formal remediation process would have identified and resolved before exposure.","A missing authentication configuration is a known technical vulnerability class; ISO 27001 requires organizations to systematically identify and remediate such weaknesses across all information assets.","The database had no password protection, directly violating the principle that access to assets must be managed and authenticated to prevent unauthorized access."]