COLUMBUS — A class action lawsuit filed by victims of a ransomware attack on the city of Columbus will move forward after the 10th District Court of Appeals reversed a Franklin County judge’s decision to dismiss the case.
The lawsuit, brought by several plaintiffs including city employees whose personal information was hacked, accuses the city of failing to follow industry standards and federal guidelines for data security, downplaying the effects of the breach and delaying remedial action. Two lawsuits filed in August 2024 were later consolidated into one.
Franklin County Common Pleas Judge Carl Aveni dismissed the case in September, ruling the city was immune from liability under Ohio law as a political subdivision — essentially, a local government.
The appellate judges disagreed, finding the city could be liable for negligence under an exception in state law that applies when a political subdivision is carrying out a “proprietary function” rather than a governmental one. A proprietary function is an activity customarily performed by nongovernmental persons that promotes public welfare, and the court ruled the city’s information technology system fits that definition.
Among the five plaintiffs who appealed the dismissal are Columbus police officers, a firefighter and a woman who provided her personal data to the city when she visited City Hall to pay a parking ticket.
The ruling sends the case back to the trial court. City officials have not yet announced whether they will appeal further.
