COLUMBUS — A state appeals court has reversed a lower court’s decision to throw out a class-action lawsuit filed by victims of a 2024 ransomware attack on the city of Columbus, allowing the case to move forward.
The 10th District Court of Appeals ruled that a Franklin County judge was wrong to dismiss the case last year. Judge Carl Aveni had thrown out the lawsuit in September, finding the city immune from liability under Ohio law because it is a political subdivision — essentially, a local government.
The appeals judges disagreed. They found the city can be held liable for negligence under an exception in Ohio law that applies when a political subdivision is performing a “proprietary function” rather than a governmental one. The court ruled the city’s information technology systems fall under that exception, because maintaining computer networks is an activity commonly performed by private businesses, not an exclusively governmental function.
The lawsuit was filed by several plaintiffs, including Columbus police officers, a firefighter and a woman who shared personal information with the city when she paid a parking ticket at City Hall. They accuse the city of failing to follow industry standards and federal guidelines for data security, downplaying the damage from the breach and dragging its feet on fixing the problems.
The city first learned of the cyberattack on July 19, 2024, and shut down its information technology network. A month later, despite assurances from Mayor Andrew Ginther that the stolen data was encrypted and unusable, cybercriminals tried to auction the data online and then released portions of it on the dark web.
Two separate class-action lawsuits were originally filed in August 2024 and later combined into one case. The plaintiffs who appealed the dismissal will now get their day in court as the case returns to the trial level.
