Two Columbus police officers filed a class action lawsuit against the city two weeks after a ransomware attack.
The two unnamed officers are alleging their personal information, bank information and even one of their lives was put at risk when stolen data was leaked. The two criticize the city's response to the attack in their lawsuit and are seeking damages from the city.
The lawsuit was filed in the Franklin County Court of Common Pleas.
Cyber criminal group Rhysida took credit for the July 18 attack on city servers.
The group listed data it said it stole on the dark web and asked bidders to offer 30 bitcoins, or close to $2 million for the data.
The lawsuit said one officer works undercover and the data breach not only puts his financial security at risk, but also his life and an operation he's working on.
One of the officers received notifications from his bank and credit card company that his social security number was compromised and found on the dark web.
The lawsuit alleges the city "lost control over that data when cybercriminals infiltrated its insufficiently protected computer systems in a data breach."
The lawsuit is very critical of the city's transparency following the cyber attack.
The lawsuit also claimed email updates from the city framed the attack as an outage affecting internet connections.
It wasn't until four days later that the employees were told it was a cybersecurity incident.
The city is offering free credit monitoring and identity protection services to some employees.
The lawsuit states the offer is insufficient to compensate the plaintiffs and others who may join the lawsuit.
