View a previous report on the search for "patient zero" in the video player above.
COLUMBUS, Ohio (WCMH) -- After Columbus residents were hammered with the revelation they could be affected by discoveries on the dark web, thousands have taken the city up on an offer of protection.
Columbus Mayor Andrew Ginther's office confirmed that as of Friday, 7,447 people had signed up for the free credit monitoring offered by the city. The sign-ups come after the Rhysida ransomware group leaked over three terabytes of stolen data from city servers onto the dark web, including files with personal information of employees and residents alike.
A spokeswoman did not specify if that number was just citizens, workers or a mixture of both. The city originally rolled out credit monitoring for just employees as a precaution, after Columbus police officers came forward with claims their bank accounts had been hacked. But once cybersecurity expert Connor Goodwolf provided NBC4 with a sample of leaked data from the dark web, it became clear the damage extended to residents as well. Columbus, in turn, extended their offer of credit monitoring to anyone affected.
The city and Experian -- the credit bureau providing the monitoring -- have both assured that taking up the offer doesn't exclude anyone from taking legal action over the leak. Meanwhile, two class-action lawsuits have piled on the city over its handling of the ransomware attack, inviting anyone affected to join their cause.
Through the course of the ransomware attack's aftermath, NBC4 has asked the mayor's office if investigators have found "patient zero," or the originating device where hackers first gained entry. SecureCyber CEO Shawn Waldman called this a necessity in stopping hacks, because if the original hole isn't plugged, the group could start the attack over again. Ginther and his team have given three answers to that question:
When Ginther first shared that the city's July 18 cybersecurity incident was a ransomware attack, he mentioned that the Rhysida ransomware group first gained access when someone downloaded a .zip file from a website. But the mayor has never named the person responsible, nor has he shared their title or department they were in, or what access they had.
The full scope of the leaked data remains unknown, partially because of the sheer size of what was uploaded by Rhysida, as well as the fact that some of the data is encrypted. But Goodwolf has told NBC4 he is downloading more portions of the leak and that there are keys to unencrypt certain files in the dump as well.
From the data that Goodwolf has parsed so far, anyone's information could potentially have been leaked if they meet one of the conditions below:
Ginther has shared a deadline of Nov. 29 to sign up for the free credit monitoring offered by the city. Since the leak has also been confirmed to affect minors, a link for them has also been added to the city's webpage for getting the deal from Experian.
Waldman has said one of the worst outcomes of a data breach can include when a bad actor takes a line of credit out in a victim's name. He stressed the importance of taking an immediate precaution to help prevent that from happening.
“I would contact all three credit bureaus and do what’s called freezing your credit,” Waldman said. “Now, that should be done regardless. Even if you’re not part of an incident, everyone should have their credit frozen. … If you go to like, buy a new car or buy a house or something, it really just takes minutes to thaw your credit.”
Contact each of the three major credit reporting agencies at the following links:
Waldman added that watching bank account activity is another helpful step.
“If you’ve got notifications that you can turn on, like your credit cards and your bank accounts, have them start notifying you about every transaction,” Waldman said. “That way you get a heads-up.”
