Does Columbus' offer after data leak exclude you from a class-action lawsuit?

COLUMBUS, Ohio (WCMH) -- As people affected by the Columbus data leak look for answers on how to protect themselves, attorneys and officials alike are providing clarity on their options between a lawsuit and an offer from the city.

After a cybersecurity expert shared a glimpse into sensitive information found on the dark web with NBC4, the City of Columbus extended its invite for free credit monitoring services from employees to anyone affected. Law firms Cooper Elliot and Meyer Wilson, who filed a class-action lawsuit against the city on behalf of its workers, adjusted their paperwork to include the public as well.

During a Saturday news conference, Mayor Andrew Ginther shared a website for anyone impacted by the dark web data dump to sign up for Experian credit monitoring, paid for by the city. While the page doesn't contain any legal agreement, it points to terms and conditions for the credit monitoring offer on Experian's website. There, the credit monitoring bureau includes language about lawsuits.

"(Experian) and you agree to arbitrate all disputes and claims between us that arise out of or relate to this agreement, which includes any Information you obtain through the services or websites, to the maximum extent permitted by law, except any disputes or claims which under governing law are not subject to arbitration … by entering into this agreement, you and ECS are each waiving the right to a trial by jury or to participate in a class action to the maximum extent permitted by law."

However, NBC4 reached out to the City of Columbus to find out if it had any fine print of its own for residents signing on for its offer. Angelo Thomas, digital media manager at City Attorney Zach Klein's office, addressed concerns surrounding the legal language.

"The City of Columbus is not attempting to disqualify anyone from seeking to join the lawsuit by providing this free credit monitoring service," Thomas said. "Rather, the purpose is to offer immediate security, protection, and peace of mind. In fact, the City’s initial offering of Experian monitoring and protection for employees was given on August 1st, more than a week before this lawsuit was filed. As with any large data breach, we strongly encourage the public to take advantage of this free protection, but anyone who feels they are impacted can reach out to their own legal counsel for guidance."

Klein, whose case database was included in the more than 200,000 files leaked by the Rhysida ransomware group, confirmed Saturday that he recused himself from defending the city against the class-action lawsuit. The mayor's office has also said that it can't comment on pending litigation.

Eric Chaffee, a professor of law at Case Western Reserve University, said that Experian had invested time and energy into a policy that requires arbitration, a form of private dispute resolution that avoids the traditional court system. But with Klein's office confirming the policy only protects Experian from a lawsuit, Chaffee said the credit monitoring service is mutually beneficial for residents and the city.

"It's in everybody's best interest that that service gets used because ultimately if it is used, it may mean that people are harmed less than they otherwise might be from this data breach," Chaffee said. "Beyond that, I mean, providing Experian identity monitoring is a good thing in the sense that it's the ethical thing to do. It protects people."

Michael Boyle, special counsel for Meyer Wilson and the plaintiffs of the class-action, also agreed with the city's assessment that the credit monitoring offer was caveat-free.

"That governs your relationship with Experian," Boyle said. "The bottom line is we don't see any indication that signing up for this credit monitoring would in any way limit your ability to participate in the lawsuit. And just to sort of say credit monitoring is usually part of -- not the entirety of, but part of -- the relief that people get in the context of these data breaches," said Michael Boyle, special counsel for Meyer Wilson.

As residents and employees consider their options from both sides, more victims are surfacing from the leaked data that went public Aug. 8 on the dark web. The dump stems from an attempted July 18 ransomware attack on City of Columbus systems, which Rhysida claimed responsibility for.