Names of undercover investigators and crime victims found on the darknet after data theft in Columbus

Recent confidential information leaked from Columbus city databases onto the dark web includes names and personal information of undercover agents and child rape victims.

Cybersecurity expert Connor Goodwolf said a database he downloaded from the dark web, which he called the prosecutor's “Matrix Crime Database,” contains all of officers' incident reports and arrest records since the mid-2010s.

This includes the names of officers and victims, personal information such as addresses and social security numbers, names of undercover police officers, and summaries of incidents and evidence such as witness statements and victim statements.

Goodwolf said this even included the names of child rape victims and domestic violence survivors.

“We're also talking about information. About victims, suspects, witnesses. That includes (personally identifiable information). That can include name, address, phone number, social security number, employment, employer. All of that is in here,” Goodwolf said.

Goodwolf claims that all of this sensitive data was not adequately protected by encryption or, as he calls it, basic cybersecurity techniques. He claims that the only data he has found online so far with such protection is city payroll data and health records.

“I could talk for hours about this one database. It's just that this information needed to be protected. Standard security measures and standard security practices should have been followed,” Goodwolf said.

RELATED: Leaked list shows people who were banned from entering buildings in the city of Columbus and who were considered a security threat

Neither the mayor's office nor the Columbus City Attorney's Office have responded to a request for comment on this latest batch of discovered documents.

The data leaked online can be traced back to the Rhysida cybercrime group, which attempted to install ransomware after a city employee downloaded an infected file, according to reports.

Although the city said it had prevented the ransomware from encrypting its files, an unknown amount of city data was leaked to the dark web by the group.

The matter is still being handled by state, city and federal law enforcement agencies.

It has already become known that the personal data of hundreds of thousands of city residents may have been accessed on the Internet.

The city offers free credit monitoring to all residents.

Goodwolf said there appear to be many particularly sensitive cases in these databases. This includes not only cases of child rape and domestic violence, but also things like protective orders.

“This is just so heartbreaking. It just makes my stomach turn,” Goodwolf said.

Goodwolf said people should take advantage of the free credit monitoring but also consider other options. He mentioned ideas ranging from as simple as changing all passwords to opening new bank accounts to even considering moving out of Columbus if data on a particularly sensitive crime were leaked.

The city is already facing class action lawsuits from multiple plaintiffs who claim the city has not done enough to protect their personal information online. These plaintiffs include former and current members of the Columbus Police and Fire Departments.

Brian Steel, president of the Fraternal Order of Police Capital City Lodge, told WOSU that he was particularly concerned about the safety of undercover officers.

“These guys are taking a lot of risks. You have to remember that these undercover agents are working undercover for drug cartels, street gangs and so on. For organized crime. That's very worrying,” said Steel.

Steel said he was even more concerned about the fact that the personal information of child rape victims was available on the dark web.

“These are things that should never be made public because they are so heinous. The details of some of these crimes are just disgusting,” Steel said.

Steel said if it turns out the data was not encrypted, he expects the city to be held accountable.

“If that's the case and the city is neglecting its basic duty to protect the public, to protect victims of crime and to protect its employees, then the FOP expects to be held accountable for that. Just as I would expect any of my members to be held accountable for completely neglecting their duties, as the city appears to be doing,” Steel said.

Goodwolf said this data is available on the dark web to anyone with the necessary, or at least limited, skills to download the files deleted by Rhysida and figure out how to open them.

Goodwolf said he believes trust in the city has been “completely eroded” following the hack.