Judge Dismisses Columbus Cyberattack Lawsuit Citing Legal Immunity

A Franklin County judge dismissed a class action lawsuit against the City of Columbus related to a 2024 cyberattack by the ransomware group Rhysida, which compromised sensitive city data including personal information of employees and residents. The plaintiffs, including city employees and residents, alleged that Columbus failed to follow federal data security guidelines and downplayed the breach's impact, resulting in fraudulent activities and data exposure. However, the judge ruled that Columbus is protected by Ohio's Political Subdivision Tort Liability Act, granting immunity to political subdivisions for governmental functions such as maintaining IT infrastructure. Despite acknowledging the plaintiffs suffered meaningful harm, the court found that because the city is a political subdivision, it cannot be held liable for damages resulting from the cyberattack. The lawsuit was dismissed with prejudice, preventing refiling, and the city maintains it acted appropriately to safeguard residents and its systems. It remains unclear if plaintiffs will appeal the decision.