COLUMBUS, Ohio (WCMH) — NBC4 Investigates has confirmed the private information of children has been compromised as part of the ransomware attack on Columbus.
The children are dependents of people who’ve interacted with the city. Now, people are asking questions about how to best protect themselves and their dependents.
The cybersecurity expert, Connor Goodwolf, who first helped NBC4 Investigates expose the extent of the breach, can no longer share what city data is on the dark web because the city is suing him. However, the legal actions against him don’t stop anyone else.
Other sources across the United States shared with NBC4 that forms saved on a city employee’s computer, profile or virtual desktop were likely grabbed in the attack.
At least two tax forms of local people that list their dependents were visible, and are now on the dark web. If a city employee listed their child as a beneficiary, their social security number is at risk.
So, how can you protect your child’s credit? NBC4 took that question to an expert at TransUnion, one of the three credit bureaus.
“Your data identity is an essential asset for your entire life,” TransUnion Head of Consumer Credit Education Margaret Poe said.
For an adult, freezing credit takes a few minutes online at each of the three credit bureaus, but for a child, it’s more complicated.
“You don’t typically think about a kid’s credit because typically a minor doesn’t have a credit report or credit history,” Poe said. “However, it is possible for a minor to have credit history.”
It could be for a straightforward reason: a guardian added a child to a credit card. Or it could not be.
“What fraudsters will do is they’ll take these disparate data points, the names and the addresses, the social security number, date of birth that are not related, and they will go synthetically create these relationships,” Sift Trust and Safety Architect Alexander Hall said.
To make sure that doesn’t happen, you can make those connections yourself: add a minor to a bank account or credit card and freeze their credit.
“What you’re going to do is pull together information that verifies your identity, their identity, and then your relationship, so it can be things like birth certificates, driver’s license for your own identity, just to basically confirm so that when you’re sending this information to us, we are confident that you are the right person to freeze that minor’s credit,” Poe said.
“For people who are feeling vulnerable because their information was compromised and that’s why they’re doing this, why is the mail-in aspect needed in this? Is there any way to do this in person?” NBC4 Investigates asked.
“No, I don’t believe there’s a way to do it in person,” Poe said. “The mail-in aspect is just because of the additional levels of documentation that we require for this process.”
Each of the credit bureaus has details on how to do this and a number to call if you need help. For TransUnion, that information can be found here. For Experian, it is here, and for Equifax, it is here.
The city’s Department of Technology is also still working to get the impacted city systems back online. As of Oct. 3, the city sent a statement saying, “72% of the city’s 441 technology systems are fully restored and 5% are partially restored. The department’s goal is to have all systems restored by the end of October.” A ransomware attack on the city of Columbus has compromised the personal information of children who are dependents of individuals connected to the city. NBC4 Investigates confirmed the breach, and now residents are concerned about how to protect themselves and their dependents.
Cybersecurity expert Connor Goodwolf, who initially helped NBC4 Investigates uncover the extent of the breach, is now unable to share further details about the compromised data on the dark web due to a lawsuit filed against him by the city. Despite this, other sources have indicated that forms stored on a city employee’s computer or virtual desktop were likely stolen in the attack. Among the exposed documents are tax forms listing dependents, meaning that if a city employee listed a child as a beneficiary, the child’s Social Security number could be at risk.
To address concerns about protecting children’s credit, NBC4 sought advice from Margaret Poe, Head of Consumer Credit Education at TransUnion. Poe explained that while adults can easily freeze their credit online, protecting a child’s credit is more complex, as minors typically don’t have credit reports or histories. However, a child could have a credit history if added to a guardian’s credit card, or through fraudulent means where criminals use stolen information to create synthetic identities.
To prevent this, Poe advises parents to freeze their child’s credit by verifying their identity and relationship to the child using documents such as birth certificates and driver’s licenses. While this process requires mailing documentation, Poe confirmed there is no option to complete this in person due to the extensive verification required.
For those impacted, each credit bureau provides specific instructions on how to freeze a minor’s credit:
– TransUnion details
– Experian details
– Equifax details
Meanwhile, Columbus’s Department of Technology continues efforts to restore city systems. As of October 3, the city reported that 72% of its 441 technology systems were fully restored, with 5% partially restored, aiming for full recovery by the end of October.
