42 Million Civic Records Exposed via Unprotected Database
Written by AI from the linked story. Not reviewed by an editor. How this works
CitySourced, operated by Granicus, left a database containing approximately 42 million civic records publicly accessible without password protection or encryption — a fundamental configuration failure. This exposed sensitive personal information including names, addresses, and phone numbers of residents who had interacted with government complaint and code violation systems. The breach highlights that organizations handling civic data must apply the same rigorous security baseline to every data store, not just high-profile systems. When a vendor or SaaS provider manages government data, any misconfiguration becomes a public trust issue with significant regulatory implications.
Tactical Insight
Immediate actions
- Audit all databases and storage systems for missing authentication controls and enforce mandatory password protection immediately.
- Enable encryption at rest and in transit for every database containing personally identifiable information (PII).
Long-term improvements
- Implement a formal cloud and database security baseline policy that mandates authentication, encryption, and access logging before any database is permitted to go live.
- Conduct regular third-party security assessments of vendor-managed platforms that store civic or government data.
- Establish a data asset inventory that classifies sensitivity levels so appropriate controls are consistently applied.
Detection measures
- Deploy continuous scanning tools (e.g., CSPM solutions) to detect publicly exposed or unauthenticated databases in real time.
- Set up alerting for any database instance that is reachable from the public internet without verified authentication controls in place.