COLUMBUS, Ohio — It's been nearly three months since the city of Columbus discovered it had been hacked. The data was then leaked to the dark web, and since then, the city has been doing what it can to restore and protect its systems moving forward.
Columbus City Council approved on Monday an additional $3 million in funding toward those recovery efforts.
"As I've said before all of us are in this together. Even the folks on this dais,” Councilmember Nick Bankston said.
Sam Orth, the technology department director for the City of Columbus, addressed the council members once again to update them on the current status of the cyberattack restoration efforts.
"It is clear that this was a very sophisticated intrusion,” he said.
Orth said as the department works to restore the city’s systems, it’s a big undertaking. He said the city manages more than 8.5 petabytes of data, which is equivalent to 2.2 trillion sheets of paper.
Since the last council meeting three weeks ago, Orth said they brought an additional 32 systems back online. His department has 106 remaining systems to restore. Orth added the goal is to have all systems restored by the end of the month.
"We have a large team to deploy to identify what data was stolen, how many records from our systems were exposed, and what types of information were compromised,” Orth said.
Bankston said the funding for the recovery efforts is coming from the Income Tax Set Aside Fund.
"We set aside 25% of every dollar that we collect from income tax to pay for in particular, our debt services. So that's how we pay for our bonds, but it's also additional monies that we set aside for emergencies like this,” he said.
In total, the city is allowing about $7 million to address the attack. About $2.5 million will go to the investigation, including cyber threat monitoring. More than $1.6 million is for Experian identity theft protection services for people affected. More than $2 million is for legal counsel, and the last $1 million is for long-term cyber threat monitoring.
"It's an investment that we would have to make regardless... So, it’s unfortunate that it had to come by way of a cyber security attack, but these types of investments are things we're going to have to continue to make as we continue to evolve in this ever-changing landscape of cyber security,” Bankston said.
The $7 million does not include the additional long-term investments the city will need to make to further protect its technology systems.
Bankston added that this funding for cybersecurity restoration is only the tip of the iceberg, and more funding will be needed to increase cybersecurity measures down the road.