Columbus City Council Meets in Closed Sessions on Cybersecurity and Legal Settlements
The private discussions follow an appeals court ruling reviving a ransomware breach lawsuit as council considers public technology measures.
Columbus City Council held dual closed-door executive sessions on Monday, Oct. 19, 2026, to discuss confidential municipal cybersecurity arrangements and confer privately with legal counsel on pending court settlements.
The proceedings took place during Regular Meeting No. 45 of Columbus City Council, October 19, 2026 at 5:00 P.M. in Council Chambers. A motion was made by Emmanuel Remy, seconded by Melissa Green, to go into Executive Session, carrying with nine affirmative votes. Council President Shannon Hardin announced that the executive session would examine confidential cybersecurity matters under Ohio Revised Code Sections 121.22(G)(5) and (6), which allow closed-door meetings for discussions covering public office security arrangements and emergency response protocols whose disclosure could reasonably be expected to jeopardize security. The council's formal agenda also scheduled an executive session under Columbus City Charter Section 8, Columbus City Code Section 111.01, and Ohio Revised Code Section 121.22(G)(3) to confer with City Attorney staff regarding legal settlements.
Appeals Court Revives Ransomware Lawsuit
The private legal and cybersecurity discussions followed a court ruling reinstating municipal liability for a cyberattack. An appeals court has reversed a Franklin County judge's decision to dismiss a class action lawsuit filed by victims of a ransomware attack against the city of Columbus. The 10th District (Franklin County) Court of Appeals ruling means that the case against the city will move forward.
City officials first detected the cyberattack on July 19, 2024, and shut down municipal IT networks. The cyberattack against Columbus resulted in half a million people's private, sensitive information leaked on the dark web. In August 2024, despite assurances from Mayor Andrew Ginther that the data was encrypted and unusable, cybercriminals tried to auction stolen data, then released parts of it on the dark web.
A Franklin County judge had previously dismissed the lawsuit after the city claimed statutory immunity as a local government. However, the appellate panel held that the city faces liability for negligence under an exception for a proprietary function rather than a governmental function. Under the ruling, a proprietary function is any action “that promotes or preserves the public peace, health, safety, or welfare and that involves activities that are customarily engaged in by nongovernmental persons” and is not a governmental function, a definition the appellate judges ruled the city's IT system fell under.
Spencer Meador, an attorney with Cooper Elliott representing the plaintiffs, said the decision allows victims to seek answers after the city attempted to end the litigation before discovery could occur. In response to the appellate ruling, the Columbus Department of Technology stated officials were reviewing options with the city attorney's office and outside counsel. On Tuesday, Oct. 20, 2026, Pique Media requested an interview with Columbus City Attorney Zach Klein regarding the executive session litigation matters.
Council Advances Public Technology Measures
During the same meeting, council addressed open-docket technology measures governing municipal cybersecurity standards and operations.
Council considered Resolution 0200X-2026 to formally adopt the updated City of Columbus Cybersecurity Program pursuant to Ohio Revised Code Section 9.64 and reaffirm the Department of Technology's ongoing administration under municipal code. The municipal resolution implements statewide cybersecurity rules enacted under House Bill 96, effective Sept. 30, 2025. Under the statute, political subdivisions must establish cybersecurity programs that safeguard data and information technology consistent with generally accepted standards such as the NIST cybersecurity framework.
Together, the two emergency procurement ordinances authorize $920,448.45 in software spending with CDW Government LLC to maintain and monitor the city's operational IT systems. The package included Ordinance 2676-2026 for $775,345.17 in cybersecurity monitoring software renewals and Ordinance 2444-2026 for $145,103.28 in SolarWinds software purchases.
Previously, Pique Media reported on Oct. 16, 2026, that Columbus City Council to Formally Adopt Updated Cybersecurity Program and Authorize CDW Contracts, and on Monday, Oct. 19, 2026, Columbus City Council Dockets Feature Emergency Spending, Water Projects, and Zoning Hearings.
How we know this
The sources and records behind this story, with the facts they support.
Columbus City Council · 2026-10-19
Supporting evidence (4)
The proceedings took place during Regular Meeting No. 45 of Columbus City Council, October 19, 2026 at 5:00 P.M. in Council Chambers.
Read supporting passage
REGULAR MEETING NO. 45 OF COLUMBUS CITY COUNCIL, OCTOBER 19, 2026 at 5:00 P.M. IN COUNCIL CHAMBERS.
A motion was made by Emmanuel Remy, seconded by Melissa Green, to go into Executive Session, carrying with nine affirmative votes.
Read supporting passage
A motion was made by Emmanuel Remy, seconded by Melissa Green, to go into Executive Session. The motion carried by the following vote: AFFIRMATIVE: 9
Council President Shannon Hardin announced that the executive session would examine confidential cybersecurity matters under Ohio Revised Code Sections 121.22(G)(5) and (6), which allow closed-door meetings for discussions covering public office security arrangements and emergency response protocols whose disclosure could reasonably be expected to jeopardize security.
Read supporting passage
President Hardin stated, “As provided for in Columbus City Charter Section 8 and Ohio Revised Code Section 121.22(G)(5) & (6), I will now entertain a motion for Council to go into Executive Session to discuss cybersecurity matters required to be kept confidential by state statutes that contain details relative to the security arrangements and emergency response protocols for public offices such that disclosure of the matters discussed could reasonably be expected to jeopardize the security of the public offices.
The council's formal agenda also scheduled an executive session under Columbus City Charter Section 8, Columbus City Code Section 111.01, and Ohio Revised Code Section 121.22(G)(3) to confer with City Attorney staff regarding legal settlements.
Read supporting passage
EXECUTIVE SESSION AS PROVIDED FOR IN COLUMBUS CITY CHARTER SECTION 8, CITY CODE SECTION 111.01 AND OHIO REVISED CODE SECTION 121.22(G)(3) TO CONFER WITH CITY ATTORNEY STAFF CONCERNING LEGAL SETTLEMENTS.
https://www.yahoo.com/news/us/articles/class-action-cyberattack-lawsuit-against-161911581.html
Supporting evidence (6)
An appeals court has reversed a Franklin County judge's decision to dismiss a class action lawsuit filed by victims of a ransomware attack against the city of Columbus.
The 10th District (Franklin County) Court of Appeals ruling means that the case against the city will move forward.
City officials first detected the cyberattack on July 19, 2024, and shut down municipal IT networks.
Read supporting passage
City officials said they became aware of the cyberattack on July 19, 2024, and shut down the city's IT network.
In August 2024, despite assurances from Mayor Andrew Ginther that the data was encrypted and unusable, cybercriminals tried to auction stolen data, then released parts of it on the dark web.
Read supporting passage
In August, despite assurances from Mayor Andrew Ginther that the data was encrypted and unusable, cybercriminals tried to auction stolen data, then released parts of it on the dark web.
However, the appellate panel held that the city faces liability for negligence under an exception for a proprietary function rather than a governmental function.
Read supporting passage
The appellate judges ruled that the city is liable for negligence in the data breach due to an exception under Ohio law that holds political subdivisions liable for negligence when they are carrying out a "proprietary function," not a governmental function.
Under the ruling, a proprietary function is any action “that promotes or preserves the public peace, health, safety, or welfare and that involves activities that are customarily engaged in by nongovernmental persons” and is not a governmental function, a definition the appellate judges ruled the city's IT system fell under.
Read supporting passage
A proprietary function is any action "that promotes or preserves the public peace, health, safety, or welfare and that involves activities that are customarily engaged in by nongovernmental persons" and is not a governmental function. The appellate judges ruled that the city's IT system fell under this definition.
https://www.yahoo.com/news/us/articles/victims-columbus-ransomware-attack-win-233000095.html
Supporting evidence (3)
The cyberattack against Columbus resulted in half a million people's private, sensitive information leaked on the dark web.
Read supporting passage
The 2024 cyberattack against Columbus resulted in half a million people's private, sensitive information leaked on the dark web.
Spencer Meador, an attorney with Cooper Elliott representing the plaintiffs, said the decision allows victims to seek answers after the city attempted to end the litigation before discovery could occur.
Read supporting passage
"The city asked the court to end this case before we were able to investigate it. And so the court of appeals actually just came out with a decision saying that it's too early for this case to be dismissed and that our firms are allowed to find some answers," Cooper Elliott Attorney Spencer Meador said.
In response to the appellate ruling, the Columbus Department of Technology stated officials were reviewing options with the city attorney's office and outside counsel.
Read supporting passage
The Columbus Department of Technology interim director sent us a statement reading: "While we respect the decision of the 10th district court of appeals, we are actively reviewing our options with the city attorney's office and outside council."
Columbus City Council to Formally Adopt Updated Cybersecurity Program and Authorize CDW Contracts
Supporting evidence (6)
Council considered Resolution 0200X-2026 to formally adopt the updated City of Columbus Cybersecurity Program pursuant to Ohio Revised Code Section 9.64 and reaffirm the Department of Technology's ongoing administration under municipal code.
Read supporting passage
On the agenda, Resolution 0200X-2026 acts to formally adopt the updated City of Columbus Cybersecurity Program pursuant to Ohio Revised Code Section 9.64; to affirm the Department of Technology’s continuing administration and implementation of the Cybersecurity Program pursuant to Columbus City Codes Section 225.011 and to declare an emergency ($0.00).
The municipal resolution implements statewide cybersecurity rules enacted under House Bill 96, effective Sept. 30, 2025.
Read supporting passage
The municipal resolution implements statewide standards under state law. The governing statute was Enacted by House Bill 96 - 136th General Assembly, effective September 30, 2025.
Under the statute, political subdivisions must establish cybersecurity programs that safeguard data and information technology consistent with generally accepted standards such as the NIST cybersecurity framework.
Read supporting passage
Under the statute, the legislative authority of a political subdivision shall adopt a cybersecurity program that safeguards the political subdivision's data, information technology, and information technology resources to ensure availability, confidentiality, and integrity, consistent with generally accepted best practices such as the national institute of standards and technology cybersecurity framework and center for internet security cybersecurity best practices.
Together, the two emergency procurement ordinances authorize $920,448.45 in software spending with CDW Government LLC to maintain and monitor the city's operational IT systems.
The package included Ordinance 2676-2026 for $775,345.17 in cybersecurity monitoring software renewals and Ordinance 2444-2026 for $145,103.28 in SolarWinds software purchases.
Read supporting passage
On the same docket, Ordinance 2676-2026 authorizes a contract with CDW Government LLC for the renewal of the cybersecurity monitoring software, waiving competitive bidding provisions of the Columbus City Code and authorizing the expenditure of $775,345.17 from the Information Services Operating Fund as an emergency. In a companion measure, Ordinance 2444-2026 authorizes a contract with CDW Government, LLC for the purchase of SolarWinds software products utilizing the State Term Contract, waiving competitive bidding provisions and authorizing the expenditure of $145,103.28 from the Information Services Operating Fund as an emergency.
Previously, Pique Media reported on Oct. 16, 2026, that Columbus City Council to Formally Adopt Updated Cybersecurity Program and Authorize CDW Contracts, and on Monday, Oct. 19, 2026, Columbus City Council Dockets Feature Emergency Spending, Water Projects, and Zoning Hearings.
Read supporting passage
Columbus City Council to Formally Adopt Updated Cybersecurity Program and Authorize CDW Contracts
Columbus City Council Dockets Feature Emergency Spending, Water Projects, and Zoning Hearings
Supporting evidence (3)
Previously, Pique Media reported on Oct. 16, 2026, that Columbus City Council to Formally Adopt Updated Cybersecurity Program and Authorize CDW Contracts, and on Monday, Oct. 19, 2026, Columbus City Council Dockets Feature Emergency Spending, Water Projects, and Zoning Hearings.
Read supporting passage
Previously, Pique Media reported on Oct. 16, 2026, that Columbus City Council to Formally Adopt Updated Cybersecurity Program and Authorize CDW Contracts
Previously, Pique Media reported on Oct. 16, 2026, that Columbus City Council to Formally Adopt Updated Cybersecurity Program and Authorize CDW Contracts, and on Monday, Oct. 19, 2026, Columbus City Council Dockets Feature Emergency Spending, Water Projects, and Zoning Hearings.
Read supporting passage
Columbus City Council convenes on Monday, Oct. 19, 2026, for two meetings that separate immediate emergency spending from capital water investments and zoning hearings.
Previously, Pique Media reported on Oct. 16, 2026, that Columbus City Council to Formally Adopt Updated Cybersecurity Program and Authorize CDW Contracts, and on Monday, Oct. 19, 2026, Columbus City Council Dockets Feature Emergency Spending, Water Projects, and Zoning Hearings.
Read supporting passage
Columbus City Council Dockets Feature Emergency Spending, Water Projects, and Zoning Hearings