Court Reinstated Columbus Ransomware Class Action Suit
The 10th District Court of Appeals ruled that the city may face liability for a 2024 data breach.
Updated on Sept. 28, 2026 in Cybersecurity
Live Poll
Should city governments be held legally liable for the loss of residents' private information?
The 10th District Court of Appeals has unanimously overturned the dismissal of a class action lawsuit filed against Columbus following a 2024 ransomware attack. The breach resulted in the exposure of private information belonging to 500,000 individuals.
Why it matters
This ruling establishes that Columbus must address claims regarding its duty of care in protecting sensitive data, potentially setting a precedent for municipal digital accountability. The decision effectively keeps the city in court to answer for security failures that exposed half a million residents.
The 2024 ransomware incident resulted in the unauthorized exposure of private records for 500,000 people. This total represents the pool of plaintiffs now seeking damages after a Franklin County judge's previous attempt to dismiss the suit was overturned.
The players
City of Columbus
The capital city of Ohio currently facing litigation regarding its digital infrastructure and cybersecurity protocols.
10th District Court of Appeals
An intermediate appellate court in Ohio responsible for reviewing trial court decisions for legal errors.
The details
The 10th District Court of Appeals determined that the lower court dismissed the lawsuit prematurely, allowing the case to proceed. Plaintiffs argue that the city maintains a duty of care, a legal obligation to exercise reasonable caution to avoid causing harm to others, regarding the storage and protection of collected personally identifiable information. The city had initially sought immunity from liability, a legal doctrine that protects government entities from being sued.
Timeline
The city of Columbus suffered a ransomware attack during 2024.
A Franklin County judge dismissed the class action lawsuit in October 2025.
The 10th District Court of Appeals reinstated the lawsuit in September 2026.
The Tech Race
This case follows the precedent of the 2024 Columbus ransomware attack, which exposed widespread vulnerabilities in municipal digital systems. The court's ruling marks a departure from the lower court's immunity stance, signaling a narrowing path for cities to claim total protection against data breach litigation.
Residents impacted by the 2024 data breach can anticipate further legal proceedings as the class action moves forward in the court system. The outcome will likely influence how the city handles future security protocols and potential compensation for affected individuals.
The takeaway
This ruling ensures that the city will face further scrutiny regarding its digital safeguards in a court of law. Monitor the Supreme Court of Ohio docket to see if the city proceeds with a formal appeal of the September 2026 appellate decision.
What happens next
The city of Columbus has the option to file an appeal of this appellate court ruling with the Supreme Court of Ohio.
Further reading
For more on evolving data protection standards, visit Cybersecurity.
Source note: This article includes information reported by NBC4i.
Live Poll
Should city governments be held legally liable for the loss of residents' private information?
