Columbus, Ohio, ransomware data might not be corrupted after all

The saga of the ransomware attack against the City of Columbus, Ohio, continues.

An anonymous cybersecurity expert told local news station WBNS Tuesday that the personal information of hundreds of thousands of Columbus residents is available on the dark web. The claim comes one day after Columbus Mayor Andrew Ginther announced to the public that the stolen data had been “corrupted” and most likely “unusable.” That assessment was based on recent findings of the city’s forensic investigation into the incident.

In an email to StateScoop responding to the anonymous claim, Ginther wrote: “Yesterday, I shared information that had been verified through our cybersecurity investigation. This information was shared in good faith, was based upon rigorous investigation and reliable sources, and was shared in an effort to offer transparency into the events of the past weeks. We are now aware that an individual has come forward with information. We are pursuing this information with the foremost concern of protecting and serving Columbus residents. We are actively evaluating additional resources to support the public and the city. As we continue to investigate, we will act on and share verifiable information,” the statement continued.

The confusion follows a ransomware attack in July, in which the international hacking group Rhysida forced the city to shut down much of its technology operations. The group has been credited with attacks on the education, health care, manufacturing, information technology and government sectors.

Last week, the city shared a fact sheet about the incident, which explains: “While the city continues to evaluate the data impacted, as of Friday August 9, 2024, our data mining efforts have not revealed that any of the dark web-posted data includes personally identifiable information.”

All reports indicate Rhysida was unsuccessful in its two attempts to auction the data it claims to have stolen from the city.

Luke Connolly, a cybersecurity expert at Emsisoft, told StateScoop that failure to sell data doesn’t prove it’s unusable.

“I can’t really comment on what the investigation did or didn’t do or find. All I can say is that I was able to view many different documents,” Connolly said. “I didn’t view all of the data, and it’s possible that some is corrupt, but I wasn’t able to verify this.”