Key Takeaways:
- Ohio’s 10th District Court of Appeals unanimously ruled the class action lawsuit against the city of Columbus should not have been dismissed.
- The lawsuit stems from a 2024 ransomware attack that leaked private information belonging to roughly half a million people onto the dark web.
- A Franklin County judge dismissed the case last October, ruling the city was immune from liability despite evidence that victims were harmed.
- The city had argued it was not at fault for the attack and asked the appeals court to uphold the dismissal.
- The case now returns to Franklin County Common Pleas Court to proceed.
Quick Facts:
What: An Ohio appeals court reinstated a class action lawsuit against the city of Columbus over its 2024 data breach.
Where: Franklin County Common Pleas Court; ruling issued by the 10th District Court of Appeals.
When: Ruling reported by NBC4 Columbus on Sept. 29, 2026; original attack occurred in July 2024.
Who: City of Columbus, ransomware victims (plaintiffs), 10th District Court of Appeals judges.
Status: Ongoing — case returns to trial court.
Source: NBC4 Columbus
What Happened
The city of Columbus was hit with a ransomware attack in July 2024 that exposed sensitive personal information belonging to about half a million people on the dark web, according to NBC4 Columbus. Victims filed a class action lawsuit, arguing the city owed a duty to protect the personal data it collects and stores.
A Franklin County judge dismissed the lawsuit last October. The judge found evidence that victims were harmed but ruled the city was legally immune from the claims, according to NBC4 Columbus. The city had argued in court that it bore no fault for the attack and pushed for dismissal.
The 10th District Court of Appeals disagreed. Its judges unanimously ruled the lawsuit should not have been thrown out, sending the case back for further proceedings.
What Officials Said
NBC4 Columbus reported the plaintiffs’ central argument: the city owes a duty of care to protect personally identifiable information because it collects and stores that data. The report did not include new statements from the city or the appeals judges beyond the ruling itself.
What This Means for Columbus Residents
Residents whose personal information was exposed in the 2024 breach may see their case move forward toward trial or settlement instead of ending in dismissal. No compensation has been awarded yet, and the case still must proceed through Franklin County Common Pleas Court. Anyone who received a data breach notice from the city in 2024 should watch for updates on class membership and potential claims.
Background
The ransomware group Rhysida claimed responsibility for the July 2024 attack, which compromised city databases, employee Social Security numbers and access to municipal camera systems. The city initially downplayed the breach’s severity before expanding free credit monitoring to all affected residents and non-residents after public pressure.
Columbus Frontline will update this story as the case proceeds in Franklin County Common Pleas Court.