New records uncovered from Columbus data leak: protection orders, court records involving juveniles

COLUMBUS, Ohio ( WCMH ) — More is being learned about the data from Columbus city services that was leaked last week onto the dark web. Among those now at risk of having personal information uncovered includes over 12,000 from criminal cases involving children and those who have requested civil protection orders.

NBC4 Investigates has been working with the cybersecurity expert who proved it was possible to access information stolen from the city that was leaked after no one purchased it at auction. This came after Mayor Andrew Ginther said Tuesday that city officials, the FBI and the federal Homeland Security department had determined the information was either encrypted or corrupted.

But that expert, Connor Goodwolf, approached NBC4 with records he initially compiled from the city attorney’s office that included the Social Security numbers of crime victims and police officers alike, and a building entry system that included driver’s license numbers. The revelation proved that not only were city employees at risk but uncounted civilians who may have gone to municipal court or visited City Hall.

Goodwolf has since continued looking through the data as he wants to bring to light who all who might be affected. A goal might include a website where people can look up if they were part of the data leak. He said Thursday he grew up around computers and coding, and he wants to put those skills to use helping others.

“I expect any I.T. person or cybersecurity expert or someone who is an engineer like myself to do the right thing,” Goodwolf said. “I’m not being paid for any of this. It’s just about doing the right thing, making sure people are safe.”

He has now determined the data leak included information from cases involving juveniles and from civil protection orders, sometimes including sealed or expunged records.

The names of over 12,000-13,000 people from cases involving juveniles are listed, a group that includes witnesses and suspects. Juvenile records are typically sealed, but within the leaked data is identifying information that includes Social Security numbers. Goodwolf said the identities of police officers are included, too, and that the leak could potentially expose undercover officers.

And information from over 5,700 protective orders can be accessed, including the names of people who were requesting protection. If you think you might be affected by this, toolkits are available for a crime victim to work on by themselves or with an advocate.

With this information, those able to access it on the dark web could potentially use it against the people who were named, including by opening lines of credit in their names. Steps, including freezing your credit report , could protect people from having their information fraudulently used.

Next, Goodwolf said he is beginning to access data from the city’s waterworks department. He wants to know whether it includes details on those who pay utility bills. And he believes the city’s security badge system for employees may be accessible, too.

“I would be concerned not just about the cybersecurity, but the physical security,” Goodwolf said. “The databases that monitor and control access to all the city buildings were leaked and [are] unencrypted. There’s photos, and … there could be references to keycard IDs.”

Ginther said credit monitoring had been extended to all city employees. The day after NBC4 reported on Goodwolf’s initial findings, Ginther further said he initially had been acting under “good faith … based upon rigorous investigation” and that the effort to protect residents continues.

For the latest news, weather, sports, and streaming video, head to NBC4 WCMH-TV.