A Franklin County judge has dismissed two lawsuits brought by anonymous Columbus police officers and a firefighter against Columbus for how the city handled a cybersecurity attack last summer.
Between two lawsuits filed in August 2024, nine anonymous officers, one of them undercover, and a firefighter accused the city of improperly handling sensitive data. Over a year ago, the city was hacked and international cybercriminal group Rhysida released city data on the dark web, including some identifying information for city employees and the full names of police officers working undercover. Other sensitive data included Social Security numbers, Franklin County Children Services reports and information about crime victims, including sexual assaults on minors.
Multiple plaintiffs in the lawsuits said that after their personal information was released on the dark web, they suffered financial losses from their bank accounts or credit cards being hacked.
Franklin County Common Pleas Judge Carl Aveni wrote in a decision filed Sept. 26 that he was granting the city’s motion to dismiss the cases because as a political subdivision in Ohio, Columbus is immune to a tort claim like this. Aveni wrote:
“The Court does not reach its conclusion in this matter lightly. Plaintiffs have allegedly suffered meaningful harm, through no fault of their own. Were the Defendant a private actor, instead of a political subdivision, Plaintiffs’ tort claims would almost certainly survive a motion to dismiss, allowing them to test their suit, shoulder their burden of proof, and seek whatever redress their evidence and the law might allow. All of that is thwarted here.”
Scott Schiff, an attorney representing plaintiffs in one of the lawsuits, said they will be appealing their case.
“It was a bad decision,” Schiff told The Dispatch. “The city is definitely not immune and we’ll be able to prove that.”
Jennifer Fening, deputy chief of staff of communications for Mayor Andrew Ginther, said in an emailed statement:
“We are pleased that Judge Aveni agrees with the city’s position that in today’s world, maintaining IT services is as fundamental a city service as shoveling snow or filling potholes. We remain firm in our belief that the City of Columbus and its leaders have acted to protect Columbus residents and the city’s technology systems, and that any harm resulting from this incident lies with the Rhysida threat actors who sought to profit from attacking our city and our residents.”
More than a year after the city discovered the hack of city systems around July 18, 2024, Ginther’s administration has released little information about how the city was breached or how the city handled the fallout behind the scenes.
Ginther’s administration has repeatedly pushed back the expected release date for a promised report. Columbus City Council has previously promised to hold a hearing when a report is ready.
Government and politics reporter Jordan Laird can be reached at jlaird@dispatch.com. Follow her on X, Instagram and Bluesky at @LairdWrites.
This article originally appeared on The Columbus Dispatch: Columbus has immunity from cyber attack lawsuits, judge rules in dismissing cases
Reporting by Jordan Laird, Columbus Dispatch / The Columbus Dispatch
USA TODAY Network via Reuters Connect
