Columbus judge sues researcher for disclosing true impact of ransomware attack

Importance of Security Researchers: Security researchers play a crucial role in safeguarding the internet against cyber threats by identifying and disclosing vulnerabilities in critical systems. Their efforts protect users and state institutions from malicious attacks. Therefore, it is concerning when a government entity takes legal action against these essential watchdogs.

Following a significant ransomware attack on Columbus, Ohio, a judge has issued a temporary restraining order against cybersecurity researcher David Leroy Ross. Ross reportedly exposed information about a security breach that officials were allegedly trying to conceal after the attack on July 18, attributed to the ransomware group Rhysida, resulted in the theft of 6.5 terabytes of sensitive data from Columbus city servers. The group attempted to auction the data for $1.7 million in Bitcoin but released a portion on the dark web when unsuccessful.

Despite initial assurances from Columbus Mayor Andrew Ginther that the stolen data was encrypted or corrupted, Ross, under the alias Connor Goodwolf, challenged these claims by revealing that the data was intact and contained highly sensitive information, including personal details of city employees and residents, confidential information from domestic violence cases, and Social Security numbers of police officers and crime victims.

In response to Ross’s disclosures, the city filed a lawsuit against him, accusing him of criminal acts, invasion of privacy, negligence, and civil conversion. The lawsuit argues that Ross interacted with criminal elements on the dark web by downloading and disseminating the data, making it more accessible to the public and posing a risk to public safety.

City attorneys claim that the dark web-posted data was not meant for public consumption and that Ross’s actions facilitated its accessibility.

A Franklin County judge issued the restraining order this week, prohibiting Ross from accessing, downloading, or sharing any of the stolen data without notifying him or allowing him to present his case.

City Attorney Zach Klein defended the legal action, emphasizing the need to prevent the dissemination of stolen criminal investigatory records and protect public safety.

Ross has criticized the city for trying to shift blame onto him for security lapses and plans to seek legal support, potentially involving the American Civil Liberties Union. Additionally, the city faces further legal challenges as civil attorneys pursue class-action lawsuits over its failure to safeguard personal information.