COLUMBUS, Ohio — A law firm representing two police officers filed a class action lawsuit Friday against the city of Columbus alleging that the city failed to protect highly sensitive data.
The lawsuit was filed by two officers, through their attorneys, on behalf of themselves and others in a similar situation regarding a cyberattack on the city's network.
Columbus Mayor Andrew Ginther's office confirmed last month that a foreign cyber threat actor attempted to disrupt the city's IT infrastructure to deploy ransomware and solicit a ransom payment from the city. The city had to sever the internet connection to reduce the threat to the city's systems.
The hacker group, identified as Rhysida, claimed to have 6.5 terabytes of city data, enough to hold more than 42 million document pages. The group claimed to have access to surveillance video, building information and personal information of employees and demanded nearly $2 million in ransom and gave the city a deadline of five days.
The complaint filed in Franklin County Court of Common Pleas alleges that in a recent cyberattack on the city's network, the city "lost control over that data when cybercriminals infiltrated its insufficiently protected computer systems in a data breach."
According to the complaint, one of the officers involved has received two notifications from his bank and one from his credit card provider that his social security number has been compromised and was found on the Dark Web. The other officer allegedly suffered concrete consequences as a result of the breach "As his information is unquestionable available to cybercriminals for nefarious purposes."
Attorney Michael Boyle, who is representing the case, said he’s handled about two dozen data breach cases over the last couple of years.
"This is by far the most serious that we've been involved with,” Boyle said.
While there are significant risks posed to all city employees impacted by the breach, Boyle explained why this is more serious for some than others, like undercover officers.
"They're concerned that this leak of this information potentially not only puts their investigations in danger but potentially puts their lives in danger and the lives of their family and friends,” Boyle said.
Boyle added there are still many questions surrounding what exactly was leaked, which is what he hopes the discovery portion of the case will uncover. Although these cases can take time, Boyle said they’re trying to move this process along as quickly as possible.
"Class actions can be fairly slow, and so part of the reason we filed this is to get it going because these things can be a fairly lengthy process,” Boyle said.
Brian Toth, Fraternal Order of Police Lodge #9 executive vice president, said he is aware of the lawsuit and that other unions are expected to direct their members to the class action lawsuit.
Columbus City Attorney Zach Klein said he's also aware that a complaint was filed, but the office has not yet been served or reviewed it.
10TV reached out to the city which said they cannot comment on pending litigation.