The city attorney’s office filed a motion to dismiss its action against the researcher, and the restraining order lapsed with it. Reporting at the time noted the dismissal came with conditions rather than as a simple withdrawal.
By then the city had also notified around 500,000 people — a figure inconsistent with data that was unusable.
Three Claims, And Only One Of Them Was Tested
The attacker said 6.5TB. The city said unusable. The researcher said readable. Only the third was demonstrated, by the crude method of opening the files in front of reporters.
The corpus grades on what is established rather than on who said it, and this incident is the strongest argument for that rule. Institutional authority predicted the wrong answer here; a demonstration predicted the right one.
What Follows For The Rest Of The Database
Roughly half this corpus rests on organisational statements: notification counts, scope descriptions, assurances that systems were unaffected. Those are graded high because they carry legal consequence and because the alternative sources are worse.
Columbus is the case where that grading would have been wrong. It does not overturn the rule — a single wrong statement does not make organisational disclosure unreliable in general — but it establishes that "the organisation said so" is a reason for confidence, not a guarantee, and this desk should not write as though the two were the same.
The Asymmetry That Remains
A wrong assurance from a city cost nothing. A correct correction from a researcher cost him a lawsuit and months under an order.
Whatever the merits of the legal position, that asymmetry determines how much independent verification any of this gets. The corpus records at 25-0502 the routes by which incidents enter the public record; none of them is "somebody checked", because almost nobody is in a position to.
Graded medium: the dismissal and the lifting of the order are reported, but this desk has not reviewed the filings and the terms attached to the dismissal are not established here.
Compiled from contemporaneous reporting of the dismissal, listed below. This desk has not reviewed the court filings and does not characterise the conditions reported to accompany the dismissal. No finding was made against the researcher. The argument about grading is this desk’s reading of what the episode implies for its own method. Graded medium. Corrections: corrections@forensicpost.com.
- Columbus drops lawsuit against data leak researcher, but with a catchNBC4 Columbus
- One year later, little detail or accountability after the ransomware attackWOSU Public Media
- Columbus ransomware attack exposes data of 500,000 residentsInfosecurity Magazine