A Franklin County judge has dismissed two lawsuits brought by anonymous Columbus police officers and a firefighter against Columbus for how the city handled a cybersecurity attack last summer.
Between two lawsuits filed in August 2024, nine anonymous officers, one of them undercover, and a firefighter accused the city of improperly handling sensitive data. Over a year ago, the city was hacked and international cybercriminal group Rhysida released city data on the dark web, including some identifying information for city employees and the full names of police officers working undercover. Other sensitive data included Social Security numbers, Franklin County Children Services reports and information about crime victims, including sexual assaults on minors.
Related ransomware attack article: Columbus hit with class action lawsuit over handling of ransomware attack
Multiple plaintiffs in the lawsuits said that after their personal information was released on the dark web, they suffered financial losses from their bank accounts or credit cards being hacked.
Franklin County Common Pleas Judge Carl Aveni wrote in a decision filed Sept. 26 that he was granting the city’s motion to dismiss the cases because as a political subdivision in Ohio, Columbus is immune to a tort claim like this. Aveni wrote:
“The Court does not reach its conclusion in this matter lightly. Plaintiffs have allegedly suffered meaningful harm, through no fault of their own. Were the Defendant a private actor, instead of a political subdivision, Plaintiffs’ tort claims would almost certainly survive a motion to dismiss, allowing them to test their suit, shoulder their burden of proof, and seek whatever redress their evidence and the law might allow. All of that is thwarted here.”
Scott Schiff, an attorney representing plaintiffs in one of the lawsuits, said they will be appealing their case.
“It was a bad decision,” Schiff told The Dispatch. “The city is definitely not immune and we’ll be able to prove that.”
Government and politics reporter Jordan Laird can be reached at jlaird@dispatch.com. Follow her on X, Instagram and Bluesky at @LairdWrites.
This article originally appeared on The Columbus Dispatch: Judge dismisses lawsuits against Columbus over 2024 cyber attack