Two years after a ransomware attack exposed at least 500,000 people's data, Columbus never released the comprehensive incident report it promised, and Mayor Ginther was nominated for a national government-secrecy award over the response

Subject of this story

Also named

What happened

A July 2024 ransomware attack by the group Rhysida crippled Columbus city computer systems and exposed Social Security numbers, driver's license data, and the identities of undercover police officers and crime victims for at least 500,000 people. Mayor Andrew Ginther initially said the attack had been thwarted with no usable data leaked; that claim was disproven within 24 hours after cybersecurity researcher Connor Goodwolf showed data had already been dumped on the dark web, and the city's law department subsequently obtained a court order restricting Goodwolf from further discussing his findings. In May 2025, Investigative Reporters and Editors named Ginther and the city finalists for its "Golden Padlock Award," given to officials who "distinguished themselves in the art of secrecy," citing the misleading public statements and the legal action against the whistleblower; Ginther's spokesperson declined to comment on the nomination. As of the one-year mark in July 2025, the comprehensive incident report city officials had promised remained unpublished, even as the city approved a $23 million multi-year "Zero Trust Network" security overhaul on top of more than $30 million already spent responding to the breach.

Sources (3)

Response

What happened next (0)

No outcome recorded yet.