# Granicus Resolves CitySourced Data Exposure

Cybersecurity researcher Jeremiah Fowler reported that CitySourced, a civic engagement platform associated with Granicus and used by local governments, exposed more than 42 million documents and nearly 450,000 files containing residents’ personal information and complaint records. Granicus said the issue was resolved in August, affected customers were notified, and it found no evidence that another party accessed the data. For public-sector buyers, the incident underscores the procurement importance of evaluating vendor security controls and confirming that contracts address breach notification and remediation practices.

- Local-government procurement teams can use the incident to review how civic technology vendors protect stored documents and residents’ personal information.
- When evaluating or renewing platform contracts, buyers should assess the vendor’s incident-response and customer-notification practices, as well as its controls for preventing unauthorized exposure.
- Granicus said affected customers were notified and the issue was resolved; the report does not identify a contract value, solicitation, or procurement deadline.

**Jurisdictions:** sled
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 29, 2026

### Government Entities
- Local governments

### Vendors
- Granicus (Provider associated with the CitySourced civic engagement platform)
- CitySourced (Civic engagement platform used by local governments)

### Sources
- [Report: Over 42 million records exposed by local government technology platform for civic engagement | StateScoop](https://statescoop.com/report-over-42-million-records-exposed-by-local-government-technology-platform-for-civic-engagement) - StateScoop