Columbus Reveals Data of 500,000 Exposed in Ransomware Incident

The City of Columbus disclosed that a July ransomware attack affected the personal information of 500,000 individuals, making it one of the more extensive government data breaches this year.

Originally described as a “potential data loss” event, the full scope of the impact only emerged in October, when city officials notified affected residents. The disclosure revealed that unauthorized access allowed attackers to obtain and later leak sensitive information on the dark web, including Social Security numbers, driver’s license details, and bank account information.

Today, the city’s authorities submitted a sample of the notification to Maine’s AG office, informing that the incident impacted 500,000 people.

Timeline of the attack and disclosure

Columbus was initially targeted by ransomware actors on July 18, 2024, who breached the city’s IT infrastructure, likely aiming to encrypt data and demand a ransom. The city’s Department of Technology quickly severed internet connectivity and successfully prevented the encryption of critical systems. At the time, officials were unsure if attackers had accessed or exfiltrated data.

Columbus officials issued a public statement on July 30, acknowledging a potential data breach and confirming that the FBI and Homeland Security were involved in the investigation. Mayor Andrew J. Ginther praised the swift response, but it was unclear then if sensitive data had been accessed or if any personal information had been compromised.

The investigation that followed confirmed on August 30 that attackers had indeed accessed personal information, expanding the scope from a contained ransomware attempt to a significant data breach. The city notified authorities and began assessing the potential risks to impacted individuals.

On October 7, notifications were circulated to impacted individuals, and today, the number of impacted individuals was publicly disclosed via an entry on the Maine portal. In addition to names, the breached data reportedly included Social Security numbers, birth dates, and financial details, now at risk of misuse due to the data’s appearance on the dark web.

Measures for Columbus residents

In light of the breach, the City of Columbus offered impacted residents two years of complimentary credit monitoring and identity protection services through Experian, covering credit report monitoring, dark web surveillance, and identity restoration support. The city also urged residents to stay vigilant, recommending they monitor financial statements and consider placing security freezes on their credit files.