500,000 Affected in Columbus Data Breach, Followed by Lawsuit Against Security Researcher

In July 2024, the City of Columbus, Ohio, experienced a ransomware attack that exposed the personal information of approximately 500,000 residents. While officials quickly took systems offline to contain the incident and reported halting the attack before ransomware encryption could be deployed, stolen data soon surfaced on the dark web.

The city later filed a lawsuit against David Leroy Ross, a security researcher known as Connor Goodwolf, who publicly claimed that resident information had been compromised. The city of Columbus argued that Ross’s statements, shared with local media, posed a risk to sensitive data disclosure during the ongoing investigation. Nearly two months after the lawsuit was filed, both parties settled, allowing the city to drop the case.

Expert Comments

Cybersecurity experts weighed in on the implications of Columbus’s actions. Casey Ellis, Founder and Advisor of Bugcrowd, criticized the lawsuit as a deterrent to transparency ...