Columbus City Attorney Zach Klein's office and cybersecurity expert David L. Ross Jr. reached an agreement Wednesday on a preliminary injunction involving information from residents that was stolen and leaked to the dark web.
A release from Klein's office said the agreement prevents Ross, who also goes by Connor Goodwolf, from spreading any information he finds following the July ransomware attack on the city that revealed personal information on city employees, residents, crime victims and others on the dark web.
That information includes credit card, driver's license and Social Security numbers, bank accounts and personal medical information.
But the agreement says Ross can maintain a dialogue with the city regarding the breach.
"The City and our counsel met with Mr. Ross several times over the past week," Klein said in a statement. "While the content of these conversations is confidential, I can say that these discussions were positive and led to an agreement submitted to the Court that prevents sensitive data from being disseminated, protects public safety and respects free speech."
"Like many, I remain concerned about anyone having access to this sensitive data, and as this investigation into the cyber intrusion continues, the City Attorney's Office will continue to keep the best interest of residents, victims, police officers and our city at heart. That remains our top priority," Klein said.
A judge granted a temporary restraining order on Aug. 29 to halt Ross from discussing the information he found after the city filed suit that same day.
A hearing on the preliminary injunction had been scheduled for Thursday.
In a texted statement late Thursday, Ross said that the agreement is a good first step, but the ultimate goal is to have the case dismissed.
"From the beginning, my goal has been to inform the public and ensure everyone's safety," Ross said. "I firmly believe individuals impacted by a cybersecurity incident should be informed immediately, rather than waiting months, to know if their personal information has been leaked to the dark web."
The suit against Ross will continue, and he has until Oct. 30 to respond.
The city has offered credit monitoring to all city residents and other impacted individuals following the attack.
