COLUMBUS, Ohio — Columbus Mayor Andrew Ginther's office says a foreign cyber threat actor attempted to disrupt the city's IT infrastructure to deploy ransomware and solicit a ransom payment from the city.
Ginther's office said that on July 18, the city's department of technology found evidence of an abnormality in its system. Once the threat was identified, the department severed the internet connection to reduce the threat to the city's systems.
Ginther said 911 and 311 were functioning, but they were also impacted by the abnormality. City employees were not able to receive or send external emails. As of Monday, the city said external email is now operational.
"The best way to describe this to the people of Columbus is there were robbers in the house, they tried to lock us out from our own house, but we stopped them," Ginther said.
The FBI and Homeland Security were called to help investigate the situation.
Investigators initially believed that the cybersecurity incident happened from an email link. They later discovered that the threat actor gained access to the city's system through a website download.
“The City of Columbus was the victim of a crime committed by an established, sophisticated threat actor operating overseas. I’m grateful for the swift and bold action of our Department of Technology, the FBI and Homeland Security to protect our IT systems, our residents and our employees,” Ginther said. “We continue to focus on restoring city services. We appreciate the grace our residents have offered us and the dedication of our employees working to keep our city running. We will support a thorough investigation and help to educate other cities on how they can avoid falling victim to similar attacks.”
The mayor says the city is identifying individuals whose personal information was potentially exposed and will provide guidance in the coming weeks.
Efforts to fully restore services to Columbus residents continue with caution, according to Ginther. The technology department is working through a methodological process to make sure the systems are hardened against further breaches before bringing them back online.
"This event is not over," Ginther said. "I want to stress that to you and to the public. We have to be vigilant about protecting our employees, protecting the public, protecting their data. We wanted to make sure that we shared this information with you all."