After Columbus cybersecurity attack, Ohio sets new rules for government agencies

COLUMBUS, Ohio (WCMH) – Just over one year after the City of Columbus experienced a ransomware attack, local governments across Ohio are preparing to update their cybersecurity policies to comply with a new state law. 

The state budget, signed by Gov. Mike DeWine in June, laid out new rules regarding cybersecurity for entities that receive government funding. The updated requirements aim to help agencies protect themselves against criminals who gain unauthorized access to computer systems and steal data, often threatening to release or erase it if they are not paid a ransom. 

The legislation requires every government agency in the state, including counties, cities, school districts and townships, to implement a cybersecurity program that safeguards their computer systems. Each program must “be consistent with generally accepted best practices for cybersecurity,” the law says. 

“It's one of the things you need to do,” Ohio Auditor Keith Faber said. “You have a lock on the building. You keep your money in a safe. All those things you do because you’re doing good government, and this is one of those functions.” 

Counties and cities must have a program in place by Jan. 1 and all other entities by July 1, according to a training session regarding the new rules hosted by CyberOhio. Faber said if the programs are not in place by the deadlines, his office will detect such violations during the audit process and issue citations.

Local governments must also establish cybersecurity training requirements for all of their employees, which can be satisfied through a free program that is already offered by the state via the Ohio Cyber Range Institute. 

Under the new rules, officials can only pay a ransom to a hacker if the local government’s legislative body formally approves the move first, through a resolution or ordinance that specifically states why doing so is “in the best interest” of the political subdivision. 

The law also mandates local officials report cyberattacks to the Ohio Department of Public Safety no later than seven days after they discover the hack, and to the state auditor no later than 30 days.

The new requirements come after multiple local governments across the state faced cyberattacks in recent years, including Columbus. A hacker group called Rhysida infiltrated the city’s servers last July, then demanded a ransom while threatening to release the data.

The city did not comply with Rhysida’s demands, and the group leaked the data it stole on the dark web. Despite Mayor Andrew Ginther's assuring residents that the stolen data was “encrypted or corrupted,” NBC4 revealed that some unencrypted personal data for residents was posted, including names from domestic violence cases and police officers’ Social Security numbers.

Jennifer Fening, deputy chief of staff to Ginther, said the city will adjust its cybersecurity strategy to “reflect the new expectations codified in the Ohio Revised Code.” She also said the city’s department of technology is investing in a Zero Trust Network, which is a security model that continuously verifies and monitors users. 

Franklin County officials are additionally working to make sure their policies are up-to-date under the new law.

“We have an active cybersecurity program based on industry standards and are dedicated to ensuring the safety and security of our technology infrastructure serving central Ohio's residents,” a spokesperson with the Franklin County Board of Commissioners said. “We are currently conducting an internal assessment of our program and collaborating with state officials to ensure compliance with the new legislation and future audits.”

The new requirements were initially introduced as a standalone bill in the Ohio House before lawmakers folded it into the 3,165-page state budget. The original legislation received support from Faber’s office, the County Commissioners Association of Ohio and Ohio Jewish Communities. It did not advance far enough to hear opponent testimony.

However, cybersecurity expert and CEO of SecureCyber Shawn Waldman said he is concerned about how the updated rules could strain the state's free resources, such as the Ohio Cyber Reserve -- a group of trained civilians who assist municipalities with cybersecurity issues. The law did not include any new funding to assist government agencies with the new requirements.

"The Reserve is an entirely volunteer corps of about 400 people," Waldman said. "So not enough people to serve literally, I think the count is over 10,000 political subdivisions in Ohio. So, I don't know how long or what the backlog is going to be for the free services."

The United States is seeing a rise in internet crime nationwide. The FBI's 2024 Internet Crime Report recorded 859,532 complaints of suspected internet crimes in 2024, with reported losses exceeding $16 billion – a 33% increase compared with 2023. 

The FBI said ransomware – malicious software criminals use to encrypt files or block access to systems in order to extort money from victims – was “the most pervasive threat to critical infrastructure” in 2024. At 3,156 complaints in 2024, ransomware reports rose 9% from 2023. 

At least 12 other states have passed laws addressing ransomware, including Florida and North Carolina, which both completely banned ransomware payments to hackers.