42M Records Exposed by Government Technology Platform
A data leak of approximately 42 million documents, containing personally identifiable information (PII) in plaintext, was discovered by a cybersecurity researcher.
Jeremiah Fowler discovered a publicly exposed database without password protection or encryption. The exposed records predominantly involved images of code violation reports or complains. Some records contained a decade’s worth of names, physical addresses, email addresses, and phone numbers. There were also several top-level application directories in the exposed repository as well as other operational folders.
This database belongs to U.S. organization CitySourced, which provides services for local government in the U.S., Canada and Caribbean.
Local government agencies are uniquely sensitive targets due to the significant disruption a cyberattack could cause.
Fowler reached out to the organization to notify it of the exposure. The database was then restricted and is no longer accessible as of current publication.
At this time, it is unknown how long the database was accessible before being restricted.
