The IT Nerd

Cybersecurity researcher Jeremiah Fowler, a frequent collaborator of ExpressVPN, discovered an unprotected, unencrypted database linked to CitySourced, a civic engagement platform owned by Granicus. The platform allows residents to report issues to local governments in approximately 184 locations across North and Central America.

Jeremiah reviewed a limited sample of the exposed database, which included:

• About 42 million documents, including 450,000 JSON files containing plaintext personally identifiable information (PII), such as names, addresses, email addresses, and phone numbers.
• Images of resident complaints and code violation reports.
• Thousands of internal records dating from 2016 to 2026, along with application directories and executable files.

You can read Jeremiah’s full findings here: https://www.expressvpn.com/research/citysourced-data-exposed

The Express VPN team ran 102 terms from Google’s Year in Search through Trends and compared the scores across locations and timeframes. A few things stood out:

• The same term failed to return identical results across countries 60% of the time, even with the region filter set to one country.
• With the filter locked to Japan and only the searcher’s location changing (via VPN), exact matches fell to 30.5%.
• The U.S. was the least consistent market we tested, with results agreeing only about half the time. Japan and India matched almost every time.
• Globally famous people, events, and places were the most reliable. Niche searches were the most volatile, and changing the timeframe (7-day, 90-day, 12-month) also shifted the patterns.

Full findings are here: https://www.expressvpn.com/research/how-google-trends-results-vary-across-ip-addresses

Cybersecurity researcher Jeremiah Fowler discovered a publicly accessible database containing 13.7 million credentials. The database appeared to be connected to Vibetech, an India-based AI software development and IT services company.

The exposed database contained:

• Personally identifiable information (PII) linked to individuals worldwide, including names, phone numbers, email addresses, passwords, and bank account details.
• Records that appeared to have been aggregated from previous security incidents.
• Data that could not be matched to known public breach disclosures, suggesting additional or previously unknown datasets.

You can read Jeremiah’s full findings on ExpressVPN’s blog here: https://www.expressvpn.com/research/vibetech-data-exposed

Recently, cybersecurity researcher Jeremiah Fowler discovered a database containing roughly 9,042,977 facial images totaling 450.2GB, in a research conducted in collaboration with ExpressVPN. The database, which appeared to be linked to ClarityCheck, a US-based reverse image search and identity verification service, was publicly accessible without password protection or encryption.

The exposed database contained:

• Facial images stored in folders labeled “faces” and “profiles,” including photos of adults, teens, and children.
• Profile pictures, screenshots, and personal photographs likely uploaded by users for searches or identity verification.

You can read Jeremiah’s full findings on the ExpressVPN blog here: https://www.expressvpn.com/blog/clarity-check-data-exposed/

Cybersecurity researcher Jeremiah Fowler recently discovered and reported to ExpressVPN about an unsecured database containing data belonging to Brazil’s Health Surveillance Information System, known as SISVISA.

The data exposed included, but was not limited to:

• Over 102,000 documents (~79GB of data), representing a significant and wide-scale security vulnerability.
• Sensitive PII, including names, CPF/CNPJ numbers, contact details, and physical addresses, with the potential to directly impact individuals’ privacy and safety.
• Regulatory and compliance records, including inspection reports, health surveillance documentation, permit applications, and backup files, heightening the risk of institutional and legal repercussions.

You can read the details here: https://www.expressvpn.com/blog/brazil-sisvisa-data-exposed/.

Cybersecurity researcher Jeremiah Fowler recently discovered and reported to ExpressVPN about multiple unsecured databases containing records linked to the Tribeca Film Festival. The exposed data included, but was not limited to:

• 666,369 total records across three unsecured databases labeled “development,” “staging,” and “production,” spanning records from 2019 to 2026.
• A production backup file with 295,916 records containing sensitive PII — email addresses, phone numbers, IP addresses, and hashed passwords — tied to users, film contacts, and more.
• Confidential documents, press kits, and marketing materials, some explicitly marked as confidential, potentially exposing A-list talent and industry professionals associated with the festival.

Jeremiah’s full findings and key takeaways are published on this blog: https://www.expressvpn.com/blog/tribeca-film-festival-data-exposed/