COLUMBUS, Ohio — Tuesday morning, Columbus Mayor Andrew Ginther said the data posted by hackers on the dark web was not usable because it was encrypted or corrupted. However, a cybersecurity expert not only said that's not true, but revealed what personal information is available.
Cybersecurity expert Connor Goodwolf, which is a name he chose for this interview and is not his legal name, said the personal data of hundreds of thousands of private citizens is now on the dark web. Those citizens are anyone who swiped their driver's license at city hall in the last 10 years. It also includes anyone who has dealt with the Columbus City Attorney's Prosecuting Office in any way, including victims, suspects, or someone who was subpoenaed by the court or law enforcement.
Goodwolf downloaded servers from the city of Columbus and showed 10TV personal information.
Goodwolf said when he heard about the data being hacked for his city, he went to the dark web to see what he could find.
“I said, 'Let’s take a look.' I saw the prosecutor’s database on there. So, I was like, 'This isn’t good',” said Goodwolf. “They contain private information, they contain social security numbers, they contain address of individuals. Especially the people at risk in this situation are victims of domestic violence, rape and other heinous crimes. Their private information is now public information."
Goodwolf showed 10TV the databases he downloaded. Goodwolf said he downloaded two databases: One from the prosecutor's office, the other is a system from the city hall building.
“This is a system where you go into the city building and if you ever go into others, you show your driver's license and scan it in. The back of your license is encoded in there with your name, address, date of birth, driver's license ID and when it expires,” said Goodwolf.
Goodwolf said it did not take him long to find the data. He said he downloaded the 22 gigabytes of data from the prosecutor’s office in about three to six hours. He found his legal name on that database.
“I felt vulnerable, sick to my stomach. I’m just a cybersecurity expert. My thoughts are the city is ignorant and negligent to levels of criminality,” he said.
Now, Goodwolf wants to sound the alarm to let people know they should be careful and to let people know they should check their credit.
“The information is out there, there’s nothing the city can do. What they can do is offer people credit monitoring, everyone affected. They need to notify everybody,” he said.
The city is providing credit checks for city employees who may be affected.
10TV confirmed a few of its employees' personal information was on that database, and it was accurate. However, when 10TV checked other names, including people who have spoken at city council, their names were not on the database.
Anyone who has visited city council and scanned their ID in the last 10 years could be affected, according to Goodwolf. Right now, there is no way to check if your information is on that database on the dark web. To be cautious, you should get your credit checked.
Wednesday morning, Ginther released a statement saying, "Yesterday, I shared information that had been verified through our cybersecurity investigation. This information was shared in good faith, was based upon rigorous investigation and reliable sources, and was shared [in an] effort to offer transparency into the events of the past weeks.
We are now aware that an individual has come forward with information. We are pursuing this information with the foremost concern of protecting and serving Columbus residents. We are actively evaluating additional resources to support the public and the city. As we continue to investigate, we will act on and share verifiable information."