The Columbus Department of Technology plans to ask Columbus City Council at its Monday meeting for over $7 million -- including $3 million in new money -- to pay for the city's ongoing response to a July ransomware attack, according to a Friday press release from Mayor Andrew Ginther's office.
The city wants the money for a variety of uses. Here's how its newly announced budget breaks down.
This budget does not include long-term investments the city will have to make to continue to protect itself from cybercrime, Ginther said in the release.
The city also announced Friday 72% of its 441 technology systems have been restored, and 5% have been partially restored nearly three months after the ransomware attack was discovered. The city's goal is to have its systems up and running "at peak efficiency" by the end of October, Ginther said in the release.
Since the Rhysida ransomware group breached the city on July 18, crippling crucial city systems and stealing over seven terabytes of personal data, the city has spent millions in its response. In July, Ginther issued an emergency order authorizing the Department of Technology to invest $4 million to "protect and restore the city's technology" and to conduct an investigation, Ginther said in the release.
The city has also incurred additional expenses paying for Experian credit protection and dark web monitoring for those affected by the breach. The city began offering the free services to residents and impacted individuals just days after Ginther told reporters the hackers had stolen corrupted and unusable data.
Cybersecurity expert David L. Ross Jr. -- who goes by Connor Goodwolf online -- showed the stolen city data available to download on the dark web contained Social Security numbers, addresses, birthdays, driver's license numbers and more just hours after Ginther said the data was unusable.
City Attorney Zach Klein later filed a restraining order against Ross, accusing him of receiving stolen property, disseminating confidential law enforcement information and causing public alarm, among other allegations. Ross was initially barred from speaking to the media, but he and the city came to an agreement in mid-September, The Dispatch previously reported.