COLUMBUS, Ohio (WCMH) -- An opportunity to get a layer of protection for free is expiring, and could help roughly half a million people affected by Columbus' data leak. But at the last update, the victim count still dwarfed sign-ups.
After attempting a ransomware attack on servers for the City of Columbus, the hacking group Rhysida pivoted to instead publicly leaking around three terabytes of data on the dark web in August. Despite Mayor Andrew Ginther saying the released files were "encrypted or corrupted," cybersecurity researcher Connor Goodwolf showed NBC4 they were accessible and contained personal data from city employees and the public alike. City Attorney Zach Klein's response was to file a lawsuit against the whistleblower, which has since been dismissed.
In previous data breaches like the Equifax hack that affected millions of Americans, free credit monitoring came as an optional prize thanks to a class-action lawsuit. But in Columbus' case, it was actually city leaders that offered free credit monitoring -- originally intended for their employees -- to anyone whose data was potentially exposed. A signup portal for the service provided by Experian has been active for at least two months, but will close Friday, Nov. 29. The city was ready for a large group, budgeting up to $1,644,348 for the protection.
But as of the beginning of November, a startlingly low percentage of the estimated 500,000 people affected by Columbus's hack have taken the city up on its offer. Department of Technology Director Sam Orth told the city council that a combined 16,500 city employees, civilians and minors signed up, or around 3% of the possible victims. That's even after assurances that the program wouldn't exclude victims from participating in either of the two class-action lawsuits leveled against the city.
Some victims have also reported real-world damage possibly stemming from the data leak. At least a dozen Columbus police officers told their chapter of the Fraternal Order of Police that their bank accounts were drained in August, a few weeks after the initial ransomware attack. Separately, one of the main plaintiffs in a class-action lawsuit against the city -- an undercover officer alleged their cover was at risk of being blown. A former Franklin County employee also told NBC4 his credit score was damaged after the hack.
To receive the free credit protection, go to columbus.gov/cyber or call 833-918-5161 with the code B129833. While confirming one person's specific information is inside the leaked data can be difficult, experts like SecureCyber's Shawn Waldman have previously recommended that it’s better to still take action.
“I generally tell people even outside of this incident, to already assume that all of your information has been compromised anyway,” Waldman said. “I would contact all three credit bureaus and do what’s called freezing your credit. ... If you’ve got notifications that you can turn on, like your credit cards and your bank accounts, have them start notifying you about every transaction."
