My data may have been stolen. What can I do?

The City of Columbus offers two years of free credit reporting via Experian to adults and minors with Social Security Numbers,⁴ and to sole-proprietor businesses operating under an SSN instead of an EIN.⁵

Enroll at Columbus.gov/cyber

You must enroll by November 29, 2024 to take advantage of this free offer.

The City says that other ways you can protect yourself include:⁴

• Change your passwords.
• Monitor your bank accounts and credit cards for unusual activity.
• Request a free credit report at annualcreditreport.com or 1-877-322-8228.⁵
• Never give out personal information over the phone, email or by text.
• Do not reply to emails asking for money, and do not click on links you don’t recognize.
• Do not reply to text messages asking for money, and do not click on links you don’t recognize.
• If you receive a weird email or text message from someone, contact them via another means such as calling them.
• Report incidents of suspected identity theft to your local law enforcement.⁶
• Report incidents of suspected identity theft to the Federal Trade Commission (the “FTC”). To file a complaint with the FTC, go to IdentityTheft.gov or call 1-877-ID-THEFT (1 (877) 438-4338). Complaints filed with the FTC will be added to the FTC’s Identity Theft Data Clearinghouse, which is a database made available to law enforcement agencies. Information on how to contact your state attorney general can be found in Appendix A to this letter.⁶
• Report incidents of suspected identity theft to your state attorney general. Ohio Residents can use this form.⁶
• Read the FTC’s guides to protecting yourself from identity theft.⁶

How can I check if my data was included in the leak?

The City of Columbus sent notices on October 7 to approximately 500,000 people whose data was included in the leak.⁶

Whether or not your data was included in the leak, you can still sign up for the two years of free credit monitoring.

Enroll at Columbus.gov/cyber

The hacking group which copied the data, Rhysida, says that they stole approximately 6.5 terabytes of data, of which they have released about 45 percent (3 terabytes) on their dark web site. Rhysida’s website is accessible to anyone with a TOR web browser.⁷

“It doesn’t take any sophistication or vast technical knowledge to access that,” [Electronic Frontier Foundation Free Speech and Transparency Litigation Director Aaron Mackey] said. “You can actually use a Google search to download a browser called Tor, which stands for ‘the onion router,’ and it allows you to actually access a lot of this material online. So it’s as sophisticated as downloading an app on your phone.” ⁸

As a side note, 3 terabytes is more data than the typical computer or phone has space to store.

What was stolen?

Based on press reports, court documents, news comments, and City staff comments, the following data was stolen:

• backups of City employee computers including folders, documents, downloads, and favorites,⁹ their computer’s Windows registry⁹, and other files saved on their computers³
• backups of City databases⁹,¹⁰
• personal information of City employees and former employees⁵ which “likely contains payroll data” ¹⁰, including names, addresses, phone numbers, bank routing numbers and account information of City employees¹⁰, and the names, addresses, and phone numbers of City employee emergency contacts²
• “Attendance Enterprise” data including paid time, vacation time, and badge numbers for 2,837 city employees²
• data “related to watershed, AEP, and the utility companies”¹⁰
• data from the City’s MATRIX Prosecutor and MatrixCrime databases, including “confidential records for cases of rape, homicide, child abuse and domestic violence,” as far back as 2014, with details including the scene of the crime, weapons used, evidence, victim injuries, victim statements, victim Social Security Numbers, victim addresses, victim phone numbers, and reports made by officers^{3 11 5}
• any report made by a resident to CPD³
• identifying details of the Columbus Police Department’s undercover officers³
• Columbus Division of Fire’s “Firehouse” database, including the SSNs of citizens involved in fire department investigations, and victims’ names, addresses, and Vehicle Identification Numbers, from 2014 to 2023²
• lists of visitors to City Hall^{11 5}
• lists of individuals allegedly banned from City buildings¹¹

Approximately 500,000 people’s data was stolen, and may include their first and last name, date of birth, bank account information, driver’s license(s), Social Security Number, and/or other identifying information concerning their relations with the City of Columbus.⁶

Was any data not stolen?

Columbus’ parking management provider ParkMobile confirmed that they do not share customer data “directly” with the City, and have received no reports of data loss connected to this hack.¹²

What next?

The City of Columbus said on September 26 that it expects to be fully recovered by “the end of October”.¹³

The City of Columbus said on October 17 that it typically takes around 150 days to recover from a cyber-attack.¹⁴ The breach occurred on July 18, 2024,¹³ so 150 days later would be around December 2024.

Help contribute to this site

This is not an official Columbus government website.

If you’re aware of a fact that isn’t listed here, and that hasn’t been reported in the press or in court, please contact local law enforcement and/or the press.

If you’re aware of a fact that has been reported in the press, or has been reported in court, send that publicly-posted link to Ben Keith via the usual methods. He has zero desire to receive the data itself, or to receive your personal original research into the data. Send that to the press.