What happened is that the City of Columbus was attacked by a ransomware group<\/a> on July 18, 2024. Due to the timing, it was at first unclear whether the disruption in the public facing services was caused by the CrowdStrike incident<\/a> or if it was in fact an attack. The attack was later claimed by the Rhysida ransomware group on their leak site, where the group posts information about recent victims that are unwilling to pay.<\/p>\n The City of Columbus said<\/a> that the city\u2019s Department of Technology quickly identified the threat and took action to significantly limit potential exposure. Due to the swift action no systems had been encrypted, but they were looking into the possibility that sensitive data might have been stolen in the attack.<\/p>\n \u201cThe city is in the process of identifying individuals whose personal information was potentially exposed and will provide notice and additional guidance to all who are impacted in the coming weeks.\u201d<\/p>\n<\/blockquote>\n Rhysida started an auction to buy the stolen data with a starting bid of about $1.7 million in bitcoin. When that didn\u2019t render any results, Rhysida published (please note the word “published” here, it\u2019s important) stolen data comprising 260,000 files (3.1 TB) which was almost half of what they claimed to have, on August 8, 2024.<\/p>\n On that same day, the mayor of Columbus stated on local media that the disclosed information was neither valuable nor usable.<\/p>\n \u201cThe fact that the threat actor\u2019s attempted data auction failed is a strong indication that the data lacks value to those who would seek to do harm or profit from it.\u201d<\/p>\n<\/blockquote>\n This is where an external security researcher comes in. Security researcher David Leroy Ross, aka Connor Goodwolf, shared information with the media about the content of the stolen data. From what Goodwolf shared it became clear that the data contained unencrypted personal information of city employees and residents.<\/p>\n So, the City of Columbus decided to sue Goodwolf for alleged damages for criminal acts, invasion of privacy, negligence, and civil conversion.<\/p>\n The lawsuit claimed that downloading documents from a dark web<\/a> site run by ransomware attackers amounted to him interacting with the ransomware group and that it required special expertise and tools.<\/p>\n When all he did was use a special browser to visit a website, download a file, and disclose the nature of the data to the local press. These actions, mind you, indistinguishable from the work of many security researchers committed to stopping cyberattacks.<\/p>\n Take, for instance, the means of access for Goodwolf. <\/p>\n If you are willing to consider the Tor Browser to be a special tool, I\u2019ll grant you that one, although grudgingly. If you are a Firefox user, you may see a big resemblance with the Tor Browser, so the browser is not really that special. If visiting a website and downloading a file is a crime, we\u2019re all guilty of said crime. If disclosing that a public official told an untruth (even if it was out of ignorance) is wrong then you probably shouldn\u2019t want to live in a democratic country.<\/p>\n But unfortunately, a Franklin County judge issued the coveted temporary restraining order<\/a> barring Goodwolf from accessing, downloading, and disseminating the City’s stolen data. The order also requires the defendant to preserve all data that was downloaded to date.<\/p>\n We want to make absolutely clear: Rhysida stole and published the data. And it was spokespeople from The City of Columbus that told everyone not to worry about other criminals using the data for further crimes, instead of warning the people that they should be wary of phishing attempts that could leverage the stolen data against them.<\/p>\n There are some actions you can take if you are, or suspect you may have been, the victim of a data breach<\/a>.<\/p>\n If you want to find out what personal data of yours has been exposed online, you can use our free Digital Footprint scan<\/a>. Fill in the email address you\u2019re curious about (it\u2019s best to submit the one you most frequently use) and we\u2019ll send you a free report.<\/p>\n![\"Rhysida](\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/09\/leak_site_pots.png\")
<\/figure>\n\n
\n
Protecting yourself after a data breach<\/strong><\/h2>\n
\n
Check your digital footprint<\/strong><\/h2>\n