Columbus' head of tech claims ransomware group ignored city before data leak

COLUMBUS, Ohio (WCMH) -- Columbus’ massive data leak has been described as a ransomware attack, but the city’s head of technology revealed something new Monday night about the incident: not only was there no ransom, attempts to negotiate with the hackers behind it went unanswered.

The Columbus City Council was on break through August, as the early investigation into an attempted ransomware attack on government servers played out. At the council's reconvening on Monday, Columbus Department of Technology Director Sam Orth avoided interviews with reporters, but did answer questions from council members.

Orth told them that the city never received a ransom demand from Rhysida, the hacking group that tried to auction off an advertised 6.5 terabytes of stolen data from Columbus servers. He said his team tried to reach out to the hacking group, but never got a response. Rhysida's auction -- which sought around $2 million in bitcoin for a starting bid -- ultimately failed, and the group instead publicly leaked 3.1 terabytes of data on the dark web.

The tech director made no mention of Mayor Andrew Ginther's previous claim the leak didn't contain anything to worry about, instead focusing on how the city responded after whistleblower Connor Goodwolf informed the public they were affected. Ginther credited investigators Aug. 13 with confirming that any data leaked was "encrypted or corrupted," but Goodwolf debunked him within the same day. He showed NBC4 that the leak contained unencrypted, sensitive data on thousands of people, potentially including anyone who had visited city hall. The city has since sued Goodwolf.

"What we learn changes by the hour," Orth told the council. "There is no such thing as a perfect defense in cybersecurity."

Orth also testified against Goodwolf in City Attorney Zach Klein's lawsuit filed Aug. 29. Despite Goodwolf trying to alert the city first about his findings, Klein accused the researcher of going "to the next level" by reporting a Columbus Division of Police database was exposed.

“Only individuals willing to themselves navigate and interact with the criminal element on the dark web, who also have the computer expertise and tools necessary to download data from the dark web, would be able to do so,” Orth wrote in an affidavit.

Franklin County Common Pleas Court records showed a hearing for a preliminary injunction scheduled for 10 a.m. Thursday in the lawsuit against Goodwolf. Orth's comments, similar to Klein's about Goodwolf needing a "level of sophistication" to access the dark web, have been repeatedly disputed by multiple cybersecurity experts NBC4 spoke with. Jeff Nathan, director of detection engineering for Netography, penned an open letter to the city calling for them to drop the case against Goodwolf. The message has racked up dozens of signatures from industry professionals.

"The fact that data published by ransomware criminals is easy and free to access has been demonstrated countless times by people of all ages and skill levels, including children," Nathan wrote. "The availability of stolen data on easily accessible platforms means the risk to Columbus citizens persists. By dropping Mr. Goodwolf's prosecution, the City of Columbus has an opportunity to refocus its efforts on mitigating these risks, informing citizens about the true nature of the breach, and taking proactive steps to enhance the city's information security posture."

Orth noted to council members that the Department of Technology had 441 city applications total, and still needed to bring 23% of them back online. The DOT was also resetting passwords for all employees and systems. Acknowledging that the leak also proved the city held data from the public and employees spanning at least two decades, Orth told the city council his team needs to review how long it keeps information, what can be deleted and when.

"What we collected 10 years ago might not be what we need to collect today," Orth said. "To the extent that we have data that we don't need anymore, if that indeed is the case, then we need to look at our retention policies and how we might change those policies going forward."