Columbus City Council Cleared of Liability in Rhysida Ransomware Attack Lawsuit
COLUMBUS, OH – A Franklin County judge has dismissed a lawsuit against the City of Columbus stemming from last year’s Rhysida ransomware attack, ruling the city is immune from liability under Ohio’s Political Subdivision Tort liability Act. The decision, handed down by Judge Aveni, effectively ends the legal challenge brought by individuals impacted by the data breach, which exposed sensitive information including details about undercover officers and criminal cases found on the dark web.
Plaintiffs argued the city was negligent in its cybersecurity measures, leading to the breach. However, Judge Aveni acknowledged the meaningful harm suffered by those affected but determined that, as a political subdivision, the city is protected from such claims. “Were the Defendant a private actor, instead of a political subdivision, Plaintiffs’ tort claims would almost certainly survive a motion to dismiss,” Aveni wrote in the ruling.The lawsuit was dismissed wiht prejudice, preventing future filings on the same grounds.
The City of Columbus welcomed the decision, stating it affirms that maintaining IT services is a essential city function, comparable to essential services like snow removal and pothole repair. ”We remain firm in our belief that the City of Columbus and its leaders have acted to protect Columbus residents and the city’s technology systems, and that any harm resulting from this incident lies with the Rhysida threat actors who sought to profit from attacking our city and our residents,” a city statement read.
Brian Steel, president of the local lodge of the Fraternal Order of Police, expressed disappointment but respect for the judge’s ruling, stating they plan to appeal the decision. The appeal process will determine whether the plaintiffs can continue their pursuit of legal recourse following the extensive data breach.
