A state appeals court has reinstated a lawsuit against Columbus over a July 2024 ransomware attack, ruling that the case cannot be dismissed at this stage on the grounds that the city is automatically immune from liability. The Ohio Tenth District Court of Appeals reversed Franklin County Common Pleas Court’s dismissal of claims by six people, including five city employees, and sent the case back for further proceedings. The plaintiffs say their personal information was compromised in the attack and allege the city failed to maintain adequate cybersecurity safeguards. The appeals court said the complaint does not establish that the city’s operation and security of its citywide information-technology system are governmental functions protected by immunity. Because private organizations commonly operate IT systems and cybersecurity programs, the court found that the claims could involve a proprietary function, which may be subject to an exception to political-subdivision immunity. The ruling is limited: It does not determine that Columbus was negligent, that the plaintiffs’ claims are true or that the city must pay damages. The city may continue to argue on remand that it is protected by a separate immunity defense. The appeals court said the trial court should consider that issue rather than dismissing the case based solely on the complaint. The attack began July 19, 2024, according to the court decision. Columbus publicly acknowledged it on July 29 and said it had identified the threat and cut internet connectivity to limit possible exposure. Cybercriminals later claimed to possess city data and threatened to sell it unless the city paid a ransom. On Aug. 5, they attempted to auction 6.5 terabytes of data, including employee login information and material from emergency-services systems, the complaint said. Some stolen data was posted online three days later. The plaintiffs include city police officers, a firefighter, another city employee and a woman who had provided information while visiting City Hall and paying a parking ticket. They allege that their information appeared on the dark web or was otherwise misused; their reported impacts include unauthorized bank or credit-card activity, ransom messages and expenses related to protecting their identities. Those allegations have not been proven in court. The lawsuit argues that the city’s consolidated IT infrastructure stored sensitive information about employees and residents, and that weaknesses in its design, security practices or employee training contributed to the breach. The city has disputed the claims and argued that its technology systems support essential public services. In its Sept. 24 decision, the appeals court said the legal question at this early stage was whether the complaint’s allegations, assumed to be true for purposes of a dismissal motion, could support a claim. It concluded that the city’s cybersecurity operations were not clearly governmental functions on the face of the complaint. The case now returns to the trial court for further proceedings.