One year later, victims still feel effects of Columbus cyberattack

COLUMBUS, Ohio (WCMH) -- This week marks one year since a ransomware group hit the City of Columbus with a massive cyberattack.

Systems went down and there were very few answers; Mayor Andrew Ginther said the data that was stolen lacked value. Then NBC4 Investigates, with the help of a whistleblower, found half a million people’s private, sensitive information, including the identities of undercover officers and crime victims, were leaked onto the dark web.

NBC4 Investigates broke this story and keeps following it, now speaking with a man who says this attack has impacted every aspect of his life with no end in sight. Some victims shared a sense of fear and disappointment in the city, while others felt the attack firsthand, with criminals attempting to destroy their credit.

However, for one man, it’s been taken to the extreme. He believes he’s a victim of the ransomware attack against the city and said he hasn’t felt like there’s been any accountability.

"It's like a never-ending nightmare," Will Klatt, a Columbus resident who believes he is a victim of the city cyberattack, said. 

In February, Klatt’s phone started to light up.

"Got probably ten calls from different banks and credit unions asking if I had set up a new credit card with them, which I had not," Klatt said. 

He spoke with the banks and found someone had used his birth date, social security number, home address, and his driver’s license.

“Basically, everything under the stars,” Klatt said. “It was the fact that they had a copy of my driver's license that made it clear that it was the city data hack.”

Over the years, Klatt has gone to City Hall, using his ID to check in. NBC4 Investigates exposed that the city stored thousands of driver's license images for 20 years, and those were stolen as part of the breach. That’s why Klatt is confident that his stolen identity is due to the hack.

“I don't think it's appropriate for that kind of information to be maintained, and if they are, they have an obligation to protect it, and when they didn't protect it, they have an obligation to make it right for the folks that they've impacted,” Klatt said. 

Klatt has called the attorney general, the FTC and tried to freeze his credit.

“The folks who stole my identity had already gone in and created accounts and all of those,” Klatt said. 

The criminals order credit cards in his name and records show that they are mailed to an address in Columbus. Klatt filed police reports but hasn’t received any answers.

“I mean, at every step, there's no one in the city who's willing to help and it's so frustrating,” Klatt said. 

“Do you feel like there has been any sort of accountability since this happened?” NBC4 Investigates reporter Isabel Cleary asked. 

“There's been no accountability, and I would hold Mayor Ginther and [City Attorney] Zach Klein as the primary folks who need to take ownership over their behavior and their reactions to this crisis,” Klatt said. “I'm going to have to petition the federal government to get a new social security number.”

NBC4 Investigates reached out to Columbus Police, the City Attorney's office and the Mayor's office for comment. 

A spokesperson for the mayor said, in part: "We are aware of this report to the Columbus Division of Police. The matter is being investigated."

The city attorney's office sent a statement saying: "The city attorney’s office is currently working with outside counsel on the investigation into the 2024 cyber intrusion and putative class action lawsuits and cannot comment further on these ongoing matters."

Columbus police have not responded to the request.