An appeals court has reversed a Franklin County judge's decision to dismiss a class action lawsuit filed by victims of a ransomware attack against the city of Columbus.
The 10th District Court of Appeals ruling means that the case against the city will move forward. In the lawsuit several plaintiffs, many of them city employees, accused the city of not following industry standards and federal guidelines for data security, downplaying the effects of the breach and delaying remedial action.
Initially, the city faced two class action lawsuits in August 2024. The two lawsuits were later consolidated into one.
The five plaintiffs who appealed the Franklin County judge's dismissal include Columbus police officers, a firefighter and a woman who provided
her personal data to the city when she visited City Hall and paid a parking ticket.
Franklin County Common Pleas Judge Carl Aveni dismissed the case in September, saying the city was immune from liability under Ohio law because it is a “political subdivision," or in other words, a local government.
The appellate judges ruled that the city is liable for negligence in the data breach due to an exception under Ohio law that holds political subdivisions liable for negligence when they are carrying out a “proprietary function,” not a governmental function.
A proprietary function is any action "that promotes or preserves the public peace, health, safety, or welfare and that involves activities that are customarily engaged in by nongovernmental persons" and is not a governmental function. The appellate judges ruled that the city's IT system fell under this definition.
The city became aware of the cyberattack on July 19, 2024, and shut down its IT network. In August, despite assurances from Mayor Andrew Ginther that the data was encrypted and unusable, cybercriminals tried to auction stolen data, then released parts of it on the dark web.
The plaintiffs allege that their personal information appeared on the dark web or that they saw fraudulent bank charges. One of the plaintiffs who said his information was on the dark web was an undercover police officer who said he feared for his safety.
Dispatch reporters Shahid Meighan and Nathan Hart contributed to this report.
Public safety and breaking news reporter Bailey Gallion can be reached at bagallion@dispatch.com.
This article originally appeared on The Columbus Dispatch: Class action cyberattack lawsuit against Columbus will move forward
