[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmW_B3peueFWsZGyRIKLT3xU5Osb6ntts4CO6U-2Hptc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"c0dbf58a-a588-4cc0-9de2-5c8527347c98","42-million-civic-records-exposed-via-unprotected-database","53148260-b0fe-4dd3-9311-31aa92c2c23b","42 Million Civic Records Exposed via Unprotected Database","CitySourced, operated by Granicus, left a database containing approximately 42 million civic records publicly accessible without password protection or encryption — a fundamental configuration failure. This exposed sensitive personal information including names, addresses, and phone numbers of residents who had interacted with government complaint and code violation systems. The breach highlights that organizations handling civic data must apply the same rigorous security baseline to every data store, not just high-profile systems. When a vendor or SaaS provider manages government data, any misconfiguration becomes a public trust issue with significant regulatory implications.","**Immediate actions:**\n- Audit all databases and storage systems for missing authentication controls and enforce mandatory password protection immediately.\n- Enable encryption at rest and in transit for every database containing personally identifiable information (PII).\n\n**Long-term improvements:**\n- Implement a formal cloud and database security baseline policy that mandates authentication, encryption, and access logging before any database is permitted to go live.\n- Conduct regular third-party security assessments of vendor-managed platforms that store civic or government data.\n- Establish a data asset inventory that classifies sensitivity levels so appropriate controls are consistently applied.\n\n**Detection measures:**\n- Deploy continuous scanning tools (e.g., CSPM solutions) to detect publicly exposed or unauthenticated databases in real time.\n- Set up alerting for any database instance that is reachable from the public internet without verified authentication controls in place.",[12,13,14,15,16,17,18],"CIS Control 3: Data Protection","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","CIS Control 18: Penetration Testing","NIS2 Article 21(2)(b)",{"GDPR Article 32":20,"NIS2 Article 21(2)(b)":21,"CIS Control 3: Data Protection":22,"CIS Control 18: Penetration Testing":23,"NIST SP 800-53 SI-2: Flaw Remediation":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"Article 32 mandates that processors implement appropriate technical measures — including encryption and access controls — to protect personal data, both of which were missing in this incident.","NIS2 requires entities to implement incident handling and risk-appropriate security measures including access control; a civic data platform with no authentication fails this baseline obligation entirely.","This control requires organizations to inventory sensitive data and enforce encryption and access controls — both of which were entirely absent from the exposed CitySourced database.","Regular penetration testing or database exposure assessments would have discovered the publicly accessible, unauthenticated database before malicious actors could exploit it.","Failing to configure basic authentication and encryption represents an unaddressed flaw in the system's security posture that a formal remediation process would have identified and resolved before exposure.","A missing authentication configuration is a known technical vulnerability class; ISO 27001 requires organizations to systematically identify and remediate such weaknesses across all information assets.","The database had no password protection, directly violating the principle that access to assets must be managed and authenticated to prevent unauthorized access.","published","2026-10-29T21:21:20.939597+00:00","2026-10-29T21:21:20.918+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F10\u002Fcitysourced-data-exposure-leaks-42m-civic-records.html","citysourced-data-exposure-leaks-42m-civic-records-55dc66","CitySourced Data Exposure Leaks 42M Civic Records",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":54,"name":55,"problem":56},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":58,"name":59,"problem":60},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]