A judge has dismissed a class action lawsuit against the city of Columbus over the 2024 data hack, ruling that the city is protected as a political subdivision under Ohio law.
In Wednesday's decision, Franklin County Common Pleas Judge Carl Aveni wrote that if the defendant was a private actor, the lawsuit's claims almost certainly survive a motion to dismiss.
The judge noted that the six unnamed plaintiffs, including Columbus police officers and one firefighter, have allegedly suffered meaningful harm through no fault of their own.
The suit asserted that the city collected and maintained a range of personally identifiable information as a condition of employment, or while they interacted with city services.
The six alleged that the city did not properly protect that information, resulting in unauthorized access and use of the information.
The ransomware attack breached the city's cyber defenses in July 2024 leaking hundreds of thousands of people's personal information to the dark web.
The suit said that one undercover officer was locked out of his bank account and feared for his personal safety.
Another officer alleged that unauthorized purchases appeared on his bank account.
A third officer claimed that his credit card was compromised and that his Social Security number and work email appeared on the dark web.
A fourth officer said he receiving emails demanding ransom and threatening to release personal information, including a home address and photo of his residence.
The court order can be appealed.
In a statement, Columbus City Attorney Zach Klein's office said: “We respect the court’s decision and will continue to legally support the DOT (Department of Technology) as we work to strengthen our cybersecurity.”
