Columbus Identifies Protected Health Information from Cyberattack
Ohio Pen/10286442

~ Columbus, OH - The City of Columbus has recently announced that a limited amount of protected health information (PHI) for less than 1,000 individuals has been identified in a Division of Fire database as involved in the July cyberattack on the city. This discovery was made as part of the city's ongoing investigation into the attack.

According to officials, the impacted database contained dispatch and other records of the Division of Fire, including brief notes about emergency medical services (EMS) provided at the location of a call. The information in these notes varied for each individual and may have included their first and last name, address, date of birth, date of service, and/or brief notes on the EMS service provided. A small number of Social Security numbers were also found in the PHI.

The city became aware of this data breach on December 12, 2024 and immediately launched a review and analysis to determine which individuals' PHI was present at the time of the attack. However, there is no evidence that the Division of Fire's encrypted electronic medical record system or financial account information was compromised. Additionally, there have been no reports or indications of any misuse or attempted misuse of personal information or PHI for identity theft or fraud.

More on Ohio Pen

• ASI Hosts 2026 Executive Business Summit for Global Partner Community
• Pastor Saeed Abedini Releases THE TRUTH – Volume 1, A Deeply Personal Story of Faith, Struggle, and Redemption
• New Book Warring From the Standpoint of the Throne Room Calls Believers to Pray From Victory
• Karate Walk Launches Walking Fitness Program Using Simple Upper‑Body Martial‑Arts Techniques
• Scotch Whisky Market Dislocation Creates Compelling Entry Opportunity for Long-Term Investors

As a precautionary measure, letters will be sent to all individuals whose PHI was contained in the impacted database. These individuals are already eligible for two years of free Experian credit and dark web monitoring services with $1 million protection against fraud and identity theft. They will have 90 days from receiving the letter to enroll in these services.

In addition to this announcement, Columbus City Council will hold an executive session tonight where Department of Technology Director Sam Orth and representatives from legal teams Dinsmore and Vorys will provide updates on the ongoing investigation. Council members will also consider Ordinance 0297-2025 which would allow access to Criminal Justice Information Service data maintained in several databases involved in the cyberattack.

Residents and individuals who may have shared their personal information with the City of Columbus are reminded that they can still sign up for these services until March 31, 2025 by visiting columbus.gov/cyber. The service will begin upon enrollment.

This news has been tagged as "Media Releases" and serves as a reminder for individuals to remain vigilant in protecting their personal information. The city continues to work towards resolving this cyberattack and ensuring the safety and security of its residents.

---

Show All News | Report Violation