The Metropolis of Columbus, Ohio, has filed a lawsuit towards safety researcher David Leroy Ross, aka Connor Goodwolf, accusing him of illegally downloading and disseminating knowledge stolen from the Metropolis’s IT community and leaked by the Rhysida ransomware gang.
Columbus, the capital and most populous (2,140,000) metropolis in Ohio, suffered a ransomware assault on July 18, 2024, which prompted numerous service outages and unavailability of e mail and IT connectivity between public businesses.
On the finish of July, the Metropolis’s administration introduced that no methods had been encrypted, however they had been trying into the chance that delicate knowledge may need been stolen within the assault.
On the identical day, Rhysida ransomware claimed accountability for the assault, alleging they stole 6.5 TB of databases, together with worker credentials, server dumps, metropolis video digital camera feeds, and different delicate data.
On August 8, after failing to extort the Metropolis, the risk actors revealed 45% of stolen knowledge comprising 260,000 information (3.1 TB), exposing a lot of what they beforehand claimed to be holding.
In accordance with the Metropolis’s criticism, the uncovered dataset consists of two backup databases containing giant quantities of information gathered by the native prosecutors and police drive, relationship again to not less than 2015, containing, amongst different issues, the non-public data of undercover officers.
On the day of the information leak on Rhysida’s extortion portal on the darkish internet, Columbus Mayor Andrew Ginther acknowledged on native media that the disclosed data was neither priceless nor usable and that the assault had been efficiently thwarted.
Just a few hours later, Goodwolf disputed the Mayor’s declare that no delicate or priceless knowledge was uncovered by sharing data with the media about what the leaked dataset included.
In response to this, on August 12, Mayor Ginther claimed that the uncovered knowledge was “encrypted or corrupted,” so the leak is unusable and must be of no concern to the general public.
Nonetheless, Goodwolf disputed these claims, sharing samples of the information with the media for example that it contained unencrypted private knowledge of individuals in Columbus.
“Among the many particulars laid naked had been names from home violence circumstances, and Social Safety numbers for cops and crime victims alike. The dump not solely impacts metropolis workers, but in addition revealed private data for residents and guests going again years,” reported NBC4.
Silencing the researcher
The lawsuit submitted by Columbus alleges that Goodwolf’s conduct of spreading stolen knowledge was each negligent and unlawful, leading to nice concern locally.
Furthermore, the Metropolis alleges that the leaked knowledge is not accessible to anyone, as Goodwolf acknowledged, because it was revealed on a platform of restricted entry, requiring information to find.
“Defendant’s actions of downloading from the darkish internet and spreading this stolen, delicate data at a neighborhood degree has resulted in widespread concern all through the Central Ohio area,” reads the criticism.
“Solely people prepared to navigate and work together with the prison component on the darkish internet, who even have the pc experience and instruments essential to obtain knowledge from the darkish internet, would find a way to take action.”
The criticism notes that Goodwolf’s sharing of regulation enforcement knowledge and the alleged plans to create a web site for individuals to see if their knowledge was uncovered interferes with police investigations.
The Metropolis seeks a short lived restraining order, preliminary injunction, and everlasting injunction towards Goodwolf to stop additional dissemination of stolen knowledge. Moreover, the Metropolis is looking for damages exceeding $25,000.
A reported by NBC4, a Franklin County choose issued the non permanent restraining order yesterday, barring Goodwolf from accessing, downloading, and disseminating the Metropolis’s stolen knowledge. The order additionally requires the defendant to protect all knowledge that was downloaded thus far.
In a press convention concerning the lawsuit, proven beneath, Metropolis Legal professional Zach Klein says that the lawsuit will not be about suppressing free speech, as Goodwolf can nonetheless discuss concerning the leak, however is geared toward stopping him from downloading and disseminating the stolen data.
Replace 8/30/24: Added non permanent restraining order.