Systems contained, data exposed: why Columbus’s reassurance outran its evidence

The week

Every city holds an enormous amount of personal information about the people it serves and employs: tax records, utility accounts, court files, police reports, payroll. In the summer of 2024, residents of Columbus, Ohio, found themselves asking what had happened to theirs.

On July 18, 2024, the City of Columbus found signs of an intrusion, meaning evidence that someone without permission had gotten into its computer network. The city disconnected its systems from the internet. Disconnecting cuts attackers off from whatever they have reached, at the cost of cutting the city off from many of its own online services.

City officials said the move had stopped the attackers before they could encrypt city systems. Encryption is what ransomware criminals typically do at the end of an attack: they scramble an organization’s files so they cannot be used, then demand payment for the key to unscramble them. Stopping that step was a real achievement. Even so, many online services and internal tools stayed disrupted for weeks, because systems that have been disconnected have to be checked and brought back carefully.

On July 29, the city published its fullest account so far. It said a foreign cyber threat actor had tried to disrupt its IT infrastructure and may have intended to deploy ransomware and demand a ransom. The city’s Department of Technology had identified the threat and limited exposure, including by severing internet connectivity. The city had brought in the FBI and the Department of Homeland Security.

The same statement gave residents some practical detail. The 911 and 311 lines had stayed in service throughout. External email was working only on city devices inside city buildings. Systems were being hardened before they came back online. Forensic work had found that the attacker got in through a file downloaded from a website, rather than through an email link as first believed.

On data, the July 29 statement was careful. It said the investigation was in its earliest stages and was still working out how much city data might have been accessed. It said the city was identifying people whose personal information may have been exposed and would send notice and guidance in the coming weeks. At that point the city’s words matched its evidence: confident about systems, explicit that the data question was still open.

Then the second half of the attack surfaced. Around July 31 and August 1, the Rhysida ransomware group, a criminal gang, claimed the attack and put data it said it had taken from the city up for auction. It said it held about 6.5 terabytes and set a price of 30 bitcoin, then roughly $1.9 million, according to local reporting. A terabyte is a thousand gigabytes; 6.5 terabytes is enough to hold millions of documents, spreadsheets and records.

The listing claimed far more than paperwork. Reports described it as offering internal logins and passwords for city employees, databases, a dump of servers that ran emergency services applications, and access to city video cameras. The buyer was promised exclusive ownership. Rhysida had previously published data when an auction found no buyer.

Rhysida was not an unknown group. In November 2023 the FBI, the Cybersecurity and Infrastructure Security Agency and the Multi-State Information Sharing and Analysis Center had issued a joint advisory on it. The advisory said Rhysida had been active since May 2023 against targets in education, healthcare, manufacturing, information technology and government. It described the group’s double extortion approach, with ransom demanded in bitcoin and stolen data threatened with publication.

Modern ransomware groups often copy data out before they try to lock anything, so that even an organization that avoids the lock-up can still be pressured with the threat of publication. By August 1, the city had already offered credit monitoring to city employees and to employees of the Franklin County Municipal Court clerk and judges. That was a sign it recognized employee data was at risk, even before it knew the full scope.

In the first week of August, residents, employees and local media were asking the question that shaped the following month: what was in the stolen data, and whose information was it?

That question was much harder to answer than whether the city’s systems were safe. The city had strong evidence about its own network. It did not yet have the stolen files in hand. As the following weeks showed, the difference between those two kinds of knowledge is where public trust is won or lost.

When a city is hit by ransomware, it has a communication problem as well as a technical one, and a very public one. Residents want to know whether they can pay a water bill, whether their personal information is safe, and whether they should be worried. Reporters want answers by deadline. Elected officials want to reassure.

In that situation, a city makes three kinds of public claim. It makes claims about its systems: what was hit, what was contained, what is back. It makes claims about the data: what was taken and whether it is readable. And it makes claims about people: who is affected and what they should do.

Each claim rests on different evidence, gathered by different teams on different timelines. Columbus had good evidence for the first claim early. Its trouble came when confidence about the systems was carried over to the data before anyone had read it. The three claims below are taken in the order in which the evidence usually arrives, after a short explainer on how modern ransomware actually works. The later sections cover how to run the three tracks inside an organization, a county’s first two weeks, what is at stake, and what to prepare in advance.

The pattern is not unique to cities. Hospitals, banks, school districts and companies face the same three claims. What makes a city instructive is that everything happens in public, under open-records laws and in front of elected officials who speak for themselves.

Steal first, lock second

Older ransomware was essentially a lock: criminals scrambled files and demanded payment for the key. Organizations responded by improving their backups, so they could restore systems without paying. Criminals adapted. Today, most serious ransomware groups run what is often called double extortion.

The sequence usually looks like this. The attackers get in, often through a stolen password or an unpatched weakness. They move around the network unnoticed to find valuable data. They copy that data out to servers they control, a step known as exfiltration. Only then do they try to encrypt systems. If the encryption fails, or the victim restores from backup, the attackers still hold the copied data. They can threaten to sell or publish it on a leak site, a website they run for exactly that purpose.

The pattern resembles burglars who first photocopy every file in an office and carry the copies away, then try to change the locks on the filing cabinets. If a security guard stops them changing the locks, that is good news for the office. It says nothing about the photocopies already in the van.

That is the heart of the Columbus story. The city stopped the locks being changed. The photocopies were a different question, and they needed different evidence.

How Rhysida works

The federal advisory on Rhysida, first issued in November 2023, describes a toolkit that explains why stopping encryption and stopping theft are separate achievements. The group commonly gained entry through remote access services such as VPNs, using valid but stolen credentials, often where multifactor authentication was missing. Once inside, it relied heavily on ordinary administrative tools. It used PsExec to move between machines, standard utilities to copy password databases, and AnyDesk to keep remote access. It also cleared event logs to cover its tracks.

Each of those steps uses software that administrators run every day. That is why the early phase of an intrusion is so hard to spot, and why theft can be complete before anyone raises an alarm. A later revision of the advisory, in April 2025, added cloud storage utilities to the list of tools observed. Those tools allow stolen data to be moved straight into cloud storage, which blends with normal business traffic.

The advisory also noted that Rhysida operated as ransomware as a service. The core group leases its tools and infrastructure to affiliates and splits the proceeds. The affiliate who breaks into a city may not be the person who runs the leak site or sets the auction price. That division of labor is one reason the public claims of such groups are often exaggerated or vague, and why a victim cannot rely on the criminals’ own description of what they took.

Why stolen data can look unreadable

Stolen data rarely arrives as a tidy set of documents. Attackers compress files into large archives, often split into numbered parts. They may grab whole database backups, which look like single opaque files until they are restored into the right database software. A leak may also be posted incomplete, with some archive parts missing or truncated.

To someone opening a few files with ordinary tools, such material can look encrypted or corrupt. Restored properly, the same material can yield structured records on large numbers of people. The difference between those two readings is a matter of skill and time, and it is the reason a quick look at a leak is not evidence of anything.

Two other terms come up below. Forensics is the detailed reconstruction of what attackers did, using logs and other records left on computers and networks. Telemetry is the stream of activity data that security tools collect from computers and networks.

Claims about systems

Containment evidence comes from the incident responders, the internal and outside specialists who investigate and stop an attack. Endpoint telemetry from individual computers, network logs and the state of backups show whether encryption ran, which hosts, meaning individual computers and servers, were touched, and when service can return. This evidence arrives within days. It supports confident statements, such as that systems were disconnected in time to prevent encryption and that a named service is restored.

It does not support statements about what left the network. Exfiltration often happens before the defenders notice anything, and stopping encryption says nothing about files already copied.

What the logs can and cannot show

Even the systems evidence has gaps that leaders should understand before they speak. Network logs that would show large outbound transfers are often kept for a short time, or not collected at all at the boundary between the network and the internet. Attackers who clear event logs on servers, as the Rhysida advisory describes, remove some of the trail. Cloud services keep their own audit logs, under retention settings that vary by license and configuration.

So the systems team can usually say with confidence which machines were touched and whether encryption ran. It can often say that data was staged for theft, for example by finding large archives in unusual folders. It can rarely say, from logs alone, exactly which files left and which did not. That last question belongs to the data track.

Communication plans should keep the two apart in their templates. A sentence of the form “we stopped the attack” belongs to the systems track. Any sentence about the impact on residents belongs to a different track, with different sign-off. In practice, that means the people who approve systems statements, typically the technology leadership, are not the same people who approve statements about data and residents. Those should involve counsel and the investigators analyzing the data.

Even systems claims have a shelf life. Forensic work can later find persistence, a hidden foothold the attackers left behind to return later, or an earlier entry point than first thought. Columbus itself revised its account of how the attacker got in, from an email link to a website download. Dating each statement, as known on a given day, leaves room to update it without a retraction. “As of Tuesday, we have found no evidence of…” ages far better than “there is no…”.

Service status is the useful systems message

Residents care less about encryption than about whether they can call for help, pay a bill, get a permit or attend a court date. Columbus’s July 29 statement did this well. It said 911 and 311 had stayed up and explained exactly where email worked. A service status page that lists each public service as working, partly working with a workaround, or unavailable answers most residents’ immediate questions without any claim about data.

Restoration order is itself a decision that deserves explanation. Emergency dispatch, payroll, payments and courts usually come first, because delays there cause direct harm or legal problems. Systems that are rebuilt and hardened before reconnection take longer, and saying so in advance reduces pressure to reconnect early.

Elected officials and the pressure to reassure

For elected officials, the systems track is also where the pressure to reassure is strongest. A mayor or county executive needs language that is accurate and useful, such as which services work, which workarounds exist and when the next update will come. Giving them that language reduces the temptation to say more. A communications team that hands an elected official nothing but “the investigation is ongoing” should not be surprised when the official reaches for something more comforting.

Governance structure shapes this pressure. In a city with a strong mayor, the mayor is the natural spokesperson and the technology department reports through the mayor’s office. In a council-manager city or a county run by a commission, several elected officials may speak independently, each with their own sense of what residents need to hear. The more voices there are, the more the organization needs a shared, dated fact sheet that every official receives at the same time.

Claims about data

Evidence about stolen data comes from analyzing the data itself. Until the organization has a copy of what was taken, or a forensic reconstruction of what was staged and sent out, any statement about its contents is a forecast.

Columbus’s public account in mid-August, that the published files were largely encrypted or corrupted, was a claim of this kind. Within days a local security researcher and news organizations showed readable personal information in the leak. The city’s statement and the evidence parted ways in public.

How to get the evidence quickly

The fix is procedural. When a ransomware group claims data, the organization needs a team ready to acquire whatever is published, in a controlled environment and with counsel’s guidance on handling. A controlled environment means isolated computers, separate from the organization’s own network, where potentially malicious files can be opened safely.

That team should index the material and classify it by data type within days, not weeks. Indexing means building a searchable catalog of every file. Classifying means sorting the contents: which files hold Social Security numbers, which hold medical details, which hold bank information, which hold nothing sensitive at all.

Three practical points surprise many leaders:

• Large leaks are searchable with ordinary tools. Several terabytes sounds overwhelming, but standard search and data-discovery software can work through it quickly.
• Corrupted archives often contain intact files. A compressed bundle that will not open as a whole can still yield thousands of readable documents.
• Backups and database dumps hold more personal data than the file shares people think of first. A single database export from a payroll or licensing system can contain records on tens of thousands of people in one file.

The steps, in order

The work follows a predictable sequence. First, acquisition: downloading what was posted, which over anonymizing networks can be slow and may take days for a large leak. Second, preservation: recording file hashes and keeping an untouched copy, so later findings can be defended. Third, unpacking: reassembling split archives and restoring database backups. Fourth, processing: extracting text, including running optical character recognition on scanned forms and police reports that are only images. Fifth, classification: automated searches for patterns such as Social Security numbers, bank account numbers and dates of birth, followed by human review of samples.

Classification should start with the categories that cause the most harm. For a city, that list usually includes Social Security and driver’s license numbers, bank details, medical information, records about victims and witnesses, juvenile records and the identities of law enforcement personnel. A first report covering those categories, even if incomplete, is far more useful than a full inventory weeks later.

Legal handling

Handling stolen data raises legal questions that counsel should settle in advance. The organization needs to be able to download and examine material that criminals have published, without creating new exposure. Records that contain criminal justice information bring obligations under the FBI’s CJIS Security Policy, including reporting to the state agency that oversees CJIS access. A city that runs an emergency medical service or a health clinic may be partly covered by HIPAA, which carries its own breach rules.

Investigations are often run through outside counsel, in part to protect the analysis under legal privilege. That protection is not guaranteed. Courts have ordered some forensic reports produced in litigation, notably in the 2020 Capital One breach case. For a public body, state open-records laws add another layer. Most have some exemption for security records, but the scope varies, and counsel should know in advance what a reporter’s records request could reach.

Outside forensic firms can do this work, but the contract and the legal arrangements need to exist before the incident. Agreeing them during one costs days, and in a public leak, days are exactly what an organization does not have. Organizations with cyber insurance should check whether the policy requires the use of the insurer’s approved vendors. Many local governments buy coverage through risk pools, and the pool’s panel may already include a firm that can do this work.

If you do not read the data, someone else will

If that analysis is not done fast, someone else does it. Journalists and independent researchers will open the leak. Their findings will then define the public record, and the organization is left reacting.

Suing or seeking to silence them draws more attention to the leak. It also casts the organization as an opponent of the people who found the problem. A better posture is to treat outside findings as input: thank the person, ask what they found, and route it into the organization’s own analysis.

There is a real tension here, and it deserves acknowledgment. Columbus argued in court that the researcher’s downloading and sharing of the data was harmful, particularly where it involved law enforcement records. Concern for the people in those records was legitimate. The better tool for that concern is a named contact who can receive a researcher’s findings, ask for restraint on specific categories, and act on them. Litigation after the findings are already public comes too late to protect anyone.

Claims about people

The third claim, who is affected, needs a further step: turning records into individuals. That means matching names, addresses and identifiers across files, removing duplicates, and finding contact details for notice. The same resident may appear in a tax file, a utility file and a court file, and should receive one clear letter, not three confusing ones.

From records to letters

Matching records to people is harder than it sounds. Names are spelled differently across systems. Addresses go stale, especially in records that go back years. Some records hold a Social Security number and nothing else, others a name and an old address. The usual approach is to match on the strongest identifiers first, then use address update services to find current mailing addresses. For people who cannot be reached, organizations fall back on substitute notice, such as website posting and media notice, where state law allows it.

Residents of other states complicate the count. A city’s records include commuters, visitors, people who paid fines or used city services and then moved away. Each person’s home state may have its own notification rules, and some states require copies of notices or reports to their attorney general. The notification count a city publishes is therefore a product of this matching work, not something that can be read off the size of the leak.

People at heightened risk

It also means identifying groups at heightened risk. A city holds data on police officers, prosecutors, crime victims, witnesses and juveniles, and exposure of their records can raise physical safety concerns as well as fraud risk. A leaked home address is a nuisance for most residents. For a police officer or a domestic violence survivor, it can be dangerous.

This step drives notification under state breach law, so counsel should be involved in setting scope. It also drives practical help, such as credit monitoring, identity restoration support and a staffed call line. For at-risk groups it may mean direct contact by the police department or prosecutor’s office rather than a form letter, plus advice on home address protection. Many states, Ohio among them, run address confidentiality programs for survivors of domestic violence and similar crimes, and victim advocates can help people enroll.

Acting before the analysis is done

Statements about people should therefore follow the analysis, not lead it. Early on, the honest message is about process: the city is analyzing the data, residents will hear more by a stated date, and anyone can act now, for example by freezing credit. A credit freeze stops lenders from opening new accounts in a person’s name without their permission, and it is free. That message is less satisfying than reassurance. It holds up when the leak is examined.

An organization can also act broadly before it knows who is affected. Columbus did this in mid-August, when it extended two years of credit monitoring to residents and non-residents whose personal information had been shared with the city or its municipal court. A broad offer of that kind makes no claim about the data. It costs more than a targeted offer, because more people enroll. It also buys time for the analysis to finish without leaving people without help.

How the three tracks run inside an organization

It is one thing to say that systems, data and people claims need different evidence. It is another to organize a response that way when everyone is exhausted and the phones are ringing. A practical structure has a small number of clearly owned roles.

• An incident lead runs the overall response and holds the master timeline of what is known, and as of when.
• The systems team, usually the technology department and outside incident responders, owns containment and restoration and feeds the systems track.
• The data team, often an outside forensic firm working through counsel, owns acquisition and analysis of anything stolen or published and feeds the data track.
• Counsel sets the legal framework: how stolen files may be handled, which notification laws apply and what each statement must and must not say.
• Communications drafts statements from approved templates for each track and makes sure every one carries an “as of” date.
• Service owners, such as police, courts, utilities and human resources, help identify the people behind the records and lead direct contact with at-risk groups.

The key discipline is that a statement can only use evidence from its own track. If the communications team wants to say something about the data, the data team must have produced the finding. If no finding exists yet, the statement describes the process instead.

A simple daily rhythm helps. Each morning, the incident lead asks each track what it now knows that it did not know yesterday, and what it still does not know. The answers go into the master timeline. Statements are drafted from that timeline, not from memory or from the most recent phone call. It sounds bureaucratic. In practice it is what stops a confident sentence about systems from drifting, under pressure, into a confident sentence about data.

For a city or county, there is one more participant: elected officials, who answer to voters and speak to the press on their own schedule. Including a briefing for them in the daily rhythm, with ready-to-use language for each track, is one of the most effective ways to keep public statements aligned with the evidence.

Fitting the tracks into existing structures

Local governments already know a structure for this. Emergency managers use the Incident Command System under the National Incident Management System, with a single incident commander, defined sections and a public information officer. Large incidents often set up a joint information center, so that every agency’s public statements come from one place. A cyber incident fits that model well, with the three tracks as units feeding the planning function and the joint information center.

Many technology departments have never used that structure, and many emergency managers have never run a cyber incident. Bringing them together in an exercise before an attack, rather than for the first time during one, avoids a week of improvisation.

How the tracks differ by type of organization

The order of evidence is the same everywhere, but the clocks differ. A health system that suffers a breach of protected health information must notify affected individuals without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more residents of a state also require notice to prominent media and to HHS within the same period. A bank must notify its primary federal regulator within 36 hours of determining that a significant computer-security incident has occurred, well before the data track has produced anything.

Broker-dealers and investment advisers face amended SEC rules under Regulation S-P, adopted in May 2024. They require customer notice within 30 days of becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed without authorization. Public companies must disclose material incidents within four business days of determining materiality. Each of these rules forces a statement before the data analysis is complete. That makes the discipline of dated, process-based language even more important outside government.

A county’s first two weeks

Suppose a county government is hit by a similar attack. On day one, its security team disconnects systems and finds that encryption was stopped. The county executive announces that systems are contained and that the county is restoring services, listing which ones work today. That is a systems claim, backed by systems evidence.

On day ten, a ransomware group posts a sample of files and claims to hold much more. The county has a pre-signed agreement with a forensic data firm. Within twenty-four hours the firm has downloaded the posted files into an isolated environment. Within five days it has indexed them and found readable payroll records and a set of sheriff’s office reports.

The county’s statement that week says: “We have obtained the files posted by the criminal group. Our analysis so far shows that they include readable personal information about some employees and some people involved in law enforcement matters. We are contacting those groups directly, starting with anyone whose safety may be at risk. Residents who want to take precautions now can freeze their credit at no cost. We will update this page every Friday.”

The statement is not comforting. It is credible, and when a reporter opens the leak, the county’s account matches what the reporter finds.

What the county did behind the statement

Behind those words sat several decisions made in advance. The sheriff’s office had a named liaison on the incident team, so that deputies whose data appeared could be called the same day. The county’s victim services unit had a script for contacting survivors whose case records were exposed. The forensic firm’s contract already allowed it to work under the county attorney’s direction. Each of those took a meeting to set up before the incident and would have taken a week to arrange during it.

The county also tracked a few numbers each day: files acquired and processed, records classified by category, individuals identified, and individuals contacted. Those numbers gave elected officials something accurate to say about progress without saying anything premature about the contents.

Trust as a working asset

For a public body, trust is the asset that makes everything else work: people pay taxes, report crimes, testify as witnesses and share information because they believe the government will handle it responsibly. A cyber incident tests that trust directly.

The costs are concrete. Notification, credit monitoring and call centers cost money. Legal exposure grows if statements turn out to be wrong. Staff morale suffers when employees learn about their own exposure from the news. And for law enforcement and courts, exposed records can endanger officers, victims and witnesses.

Trust also has an operational side. Victims and witnesses who believe their information is unsafe with the police may be slower to come forward. Employees who learn of their exposure from a reporter may be slower to believe the next internal message. These effects are hard to measure, but they last longer than the outage.

The case for saying less, and its limits

The strongest counter-argument to the three-track approach is that it can sound evasive. Residents and reporters want answers, and a city that says “we are analyzing the data” for two weeks may face criticism for hiding something. Officials may also argue that calm public statements prevent panic and keep people using city services.

Both concerns are real. The answer is that process statements need not be empty. A city can say which services work, what it is doing to get the data, when it will report again and what residents can do now. That gives people something to act on. The risk of an early reassuring claim is asymmetric: if it holds, the gain is small, and if it fails, the loss of credibility affects every later statement.

The same pattern applies to banks, hospitals and companies. Any organization that holds personal data will face the same gap. One sentence says “we have contained the attack.” The other says “we know what was taken.” The organizations that come through best are the ones that never let the first sentence stand in for the second.

Preparing the three tracks in advance

Most of this can be prepared before an incident. The materials are a template set split into the three claim types, a pre-contracted data analysis capability, and a map of where the city keeps its most sensitive personal records. The map should cover law enforcement, courts, utilities, licensing and payment systems, so that exposure can be judged quickly once files appear.

Shrinking what can be stolen

The cheapest way to make the data track easier is to hold less data. Old database backups, exports copied to file shares for a one-time project and records kept past their retention schedule all enlarge what a leak can contain. A city that enforces its records retention schedules on digital copies, and inventories where database backups live, reduces both the harm of a leak and the time needed to analyze it.

A front door for researchers

Organizations should also decide in advance how outside researchers can reach them. A published security contact, monitored by someone with authority to act, gives a researcher an alternative to going straight to the media. It also gives the organization a chance to ask for restraint on the most sensitive categories while it notifies the people involved.

Exercises and support

A tabletop exercise built around the three tracks is a useful test. The scenario should include a leak posted on day ten and a reporter’s call about readable records on day twelve. Federal and state support exists for this work. CISA offers exercise packages and advisory services to state and local governments at no cost, and the State and Local Cybersecurity Grant Program has funded cybersecurity planning in many jurisdictions since 2022.

The failures are predictable:

• Letting a systems success answer a data question. “We stopped encryption” is not evidence that stolen data is harmless.
• Describing stolen data before reading it. Words like “corrupted” or “unusable” should come only from the organization’s own analysis of the actual files.
• Undated statements. Claims without an “as of” date turn every later discovery into a contradiction.
• No pre-arranged help. Negotiating forensic contracts during the incident loses days.
• Treating outside researchers as adversaries. They will find what is in the leak whether or not the organization engages with them.
• Form letters for people at risk. Officers, victims and witnesses need direct, personal contact.

Who speaks, and on what evidence

1. If we were attacked tomorrow, who would approve statements about our systems, and who would approve statements about stolen data? Are they different people?
2. Do we have contracts in place today with a firm that can download, index and classify published stolen data within days?
3. How would we contact people whose physical safety could be at risk, and who would do it?
4. Do our draft statements carry an “as of” date, so they can be updated without being retracted?
5. How would we respond if a journalist or researcher told us they had found readable data in a leak?

Each answer should name a person and a document. An approver who exists only as a job title, or a forensic contract that exists only as an intention, will not help on the day. The test is whether the person named could act within an hour of a phone call on a Saturday.

The answers should also be reviewed after every exercise and every real incident, including incidents at peer organizations. When another city or county stumbles in public, the cheapest lesson available is to walk through its timeline and ask where the same gap would appear at home.

With hindsight

The weeks after the auction showed, step by step, how the gap between systems evidence and data evidence plays out in public.

Rhysida published a large part of the data around August 8, 2024, after the auction found no buyer. BleepingComputer reported that the dump held about 260,000 files, or 3.1 terabytes, roughly 45 percent of what the group claimed to have taken. In mid-August Mayor Andrew Ginther said the published data was encrypted or corrupted and of little use. A local security researcher and news reports showed it contained readable personal records, including material on police officers, prosecutors and crime victims.

The city’s own court filing later described what made the leak so sensitive. According to the complaint, the dump included two backup databases holding information gathered by local prosecutors and police going back to at least 2015, including personal details of undercover officers. Samples the researcher shared with media showed names from domestic violence cases and Social Security numbers of police officers and crime victims.

On August 29 the city sued the researcher and obtained a temporary restraining order limiting his sharing of the data, which drew criticism from press freedom and security groups. The order barred him from accessing, downloading and spreading the city’s stolen data and required him to preserve what he had already downloaded. The city argued that the data was not truly public because finding it on the dark web took specialist knowledge.

The legal dispute wound down over the autumn. On September 11 the city attorney’s office and the researcher agreed to a preliminary injunction. In October 2024 the city dropped the suit, with the researcher agreeing to a permanent injunction on sharing personal data from the leak. The agreed terms barred him from disclosing specific categories such as Social Security numbers, driver’s license and bank details and medical information, while leaving him free to talk about the incident. He said publicly that he had wanted a designated person at the city to report sensitive findings to.

The city then moved toward the people track. On August 16, before its analysis was finished, it offered two years of credit monitoring to residents and others whose information it held. In early October it notified about 500,000 people that their information was involved. Notification letters filed with Maine’s attorney general listed data that may have included names, dates of birth, addresses, bank account information, driver’s license numbers and Social Security numbers. The city said it had found no evidence that the data had been misused.

Looking back, each stage of the Columbus story lines up with one of the three claims. The systems claim, that encryption had been stopped, was made early and held up. The data claim, that the files were of little use, was made before the evidence supported it and did not hold up. The people claim, about 500,000 notified, came last, as it usually does, once the records had been turned into individuals. The broad credit monitoring offer in August, made without any claim about the data, was the step that aged best.

The federal picture of Rhysida kept developing. In April 2025 the FBI, CISA and the MS-ISAC revised their joint advisory on the group. The update added cloud storage utilities to the tools observed and noted that its actors had sometimes used a malware loader for initial access. The revision reinforced the central point of this article: theft can be fast, hard to see on the network and complete before encryption is attempted.

The support system for local governments also changed. The MS-ISAC, a principal source of threat information and incident help for cities and counties, moved to a member-funded model in 2025. For smaller jurisdictions, that raised the importance of the in-house preparation described above, from forensic contracts to pre-written statements.

Ransomware groups have kept publishing local government data since. The order of evidence described here, systems first, then data, then people, has not changed. Any public body, or any organization that holds personal records, should plan statements around that order, and make sure no one is asked to speak about the data before someone has actually read it.