City of Columbus sues researcher for sharing stolen data it claimed was unusable
A cybersecurity researcher faces possible legal consequences after he was accused of illegally downloading data stolen in a cyberattack and sharing it with the media.
In July, the city of Columbus, Ohio, was hit by a ransomware attack by the Rhysida ransomware group.
The incident caused system outages to email and other public agency resources.
While the city believes no data was encrypted, Rhysida claimed to have stolen 6.5 terabytes of data, 45 percent of which (260,000 files larger than 3.1 terabytes) were released when the city refused to pay the rescue.
Initially, Columbus Mayor Andrew Ginther said the leaked data was worthless and the attack had been ineffective.
However, cyber researcher David Leroy Ross, better known as Connor Goodwolf, criticized the mayor, accusing him of a false claim and shared with the media what the leak included.
When Ginther responded by saying that the data was unusable because it was “encrypted or corrupted”, Goodwolf shared samples with the media to prove that the data was not encrypted.
This data included Social Security numbers of police officers and criminals, names of domestic violence cases, and other personal information.
Columbus then filed a lawsuit against Goodwolf, saying that sharing stolen data was illegal and careless and that the data was inaccessible to most people since it was published on a platform that required expertise to access.
The lawsuit seeks to obtain a temporary restraining order against Goodwolf, as well as a preliminary injunction, a primary injunction and damages of more than US$25,000.
So far, the temporary restraining order is the only thing that has been issued, preventing Goodwolf from accessing, downloading or sharing any further data. All data downloaded so far must also be retained.
Goodwolf is still allowed to speak about the leak, according to City Attorney Zach Klein, who added that the lawsuit is not intended to suppress free speech, but rather to prevent further dissemination of data.
