Columbus Division of Police and Columbus City Attorney databases were leaked on the dark web, where local cybersecurity expert Connor Goodwolf was able to download them.
These police and city attorney databases include sensitive investigatory records that contain personal information like birth dates and full names of crime suspects, witnesses and victims, addresses, and Social Security numbers.
“I can go on for hours just on this one [crime] database. It’s just this information should have been protected. Common security, standard security practices should have been followed,” said Goodwolf, who doesn’t use his legal name.
“Had the city actually implemented transparent data encryption on all the databases, the data would have been unusable. But that was not the case,” he added.
The leak also includes the disclosure of the full names of undercover police officers along with detailed descriptions of their activities.
“These are where all the police reports go, all of the incident reports go. Regardless of what it is, every report. Every time an officer is deployed, they have to make a report. It’s anything from a traffic stop, going to a home or business, reports of child abuse, shots fired,” said Goodwolf.
“Officers who do undercover work regularly, now their names, the work they do is out there. We are talking about the old vice unit, which is now PACT. We are talking about units that handle gang crimes, guns,” he added.
The data, going back to 2014, is believed to have been obtained as part of the citywide cyberattack by ransomware group Rhysida after it hacked the city of Columbus in July.
The hackers stole a total of 7 terabytes of city data that they then auctioned on the dark web. Rhysida publicly released 45% of the full dataset. The remaining 55% of it was sold to buyers, according to the group’s website.
“The potential consequences are personal and professional risks to those involved and a broader erosion of trust in the city’s ability to protect its citizens and employees,” said Columbus Fraternal Order of Police Lodge #9 President Brian Steel. “If negligence within the city government contributed to this breach, those responsible must be held accountable.”