COLUMBUS, Ohio — The investigation continues into the cybersecurity attack against the City of Columbus.
There are still many questions that remain unanswered, like when the attack happened and exactly what data was leaked to the dark web.
The city has not answered many of our questions, citing an ongoing investigation, and every department we ask refers us to Mayor Andrew Ginther.
“I have been seeing one municipality after another getting breached. Every time I want to throw up my arms and say 'Hey, we need to upgrade our security no matter who you are,'” said Bob Carver, CEO of Cyber Security Boardroom.
Carver is a cybersecurity expert who has helped secure Fortune 100 companies for more than 25 years.
“I know a lot of municipalities have always been tight on budgets and that sort of thing, and personnel. Unfortunately, we are at a stage where what we call 'good enough security' is no longer a good enough defensive game against these cyber threat people,” Carver explained.
Through a public records request, 10TV obtained a contract between the city and law firm Dinsmore.
The document is dated July 23, but the contract term starts July 19.
Ginther said on July 18 he decided to disconnect the city from all outside communication to protect information.
On July 22, 10TV's Lacey Crisp asked Ginther about the attack and if it was a security breach. He responded, “We are not prepared to speak to that at this point. Obviously, we are looking at everything right now, making sure we have all the facts and information before we share information with the public.”
The city is paying Dinsmore $395 an hour.
If that amount exceeds $300,000, the city will need to get approval from Columbus City Council for additional funds.
The scope of the work is to, "act as special legal counsel for the purpose of providing legal advice to the director of the department of technology with respect to matters pertaining to cybersecurity."
Carver says if he were to give the city advice, “I think leverage good guys, the white hats that are out there that are security researchers. Speed up the process and maybe even to have more information than what he has right now.”
Carver argues instead of suing Connor Goodwolf, who alerted 10TV to city data on the dark web, the city should have looked to use his expertise.
“It might not look real good in the investigation, it could have slowed down the investigation which could cause the city to spend more money to fix this thing,” Carver said.