Listen: When whistleblower discovered data leak's danger, he warned Columbus first

COLUMBUS, Ohio (WCMH) -- A whistleblower's phone call went unanswered when he tried to warn City of Columbus officials first about the scope of compromised data, according to a record uncovered Wednesday.

After Mayor Andrew Ginther claimed on Aug. 13 that three terabytes of sensitive information posted to the dark web were "encrypted or corrupted," Connor Goodwolf proved him wrong. Downloading a snippet of the leak posted by the Rhysida ransomware group, he showed the hackers had exposed the personal information of city employees and the public alike.

As Goodwolf's research into the data went further and further, City Attorney Zach Klein reacted by suing him on Aug. 29. With a judge ordering Goodwolf to halt his work, Klein accused the whistleblower of leaving Columbus out of the conversation.

"If there is information that needs to be brought forward, there is a way to disclose that information to law enforcement, and not going directly to the media, and this is why we had to file the TRO," Klein said.

But before Goodwolf and NBC4 broke the news of just how severe the leak was, he tried to warn the city the previous day. A records request to the City of Columbus turned up the voicemail Goodwolf left with its Department of Technology. Dinsmore, the city's outside law firm, told NBC4 that Goodwolf sent the message on Aug. 12.

"Hi. My name is Connor Goodwolf … you probably want to give me a call. I'm going to the news right now with regards to all the data that was exposed and someone in the DOT is lying (unintelligible) Ginther or to cover their own ass. So if you give me a call back, I would appreciate it. I will walk you all through the data since HR is there to protect the company, or in this case, the municipality. You'll want all the facts and all the information, so give me a callback. I'll gladly walk you through everything. I'm going to also be taking the data, as I said, to NBC News 4, to the lawyers suing the city and I will be publishing an analysis of each database that was leaked. None of it was corrupted. But give me a call back, I appreciate it. Thanks, bye." 

Connor Goodwolf

NBC4 pressed Klein about Goodwolf's attempts to contact the city during his news conference announcing the lawsuit. After proving the danger of the leak, the station connected Dinsmore with the whistleblower. Goodwolf also provided screenshots of his call history, which showed he not only called the Department of Technology three more times before his first interview, but also reached out to at least four staff members in Klein's office.

"Well, first and foremost, I have 175 people work with me, and no one has ever came to me, directly or indirectly and said, 'Connor Goodwolf wanted to talk to me,' period, full stop," Klein replied. "Secondly, I know my outside counsel has talked to Connor Goodwolf. Those conversations did occur. Those communications broke down and I'll leave it at that, because it's a part of the pending investigation."

When NBC4 shared the specific names of Klein's staff that Goodwolf called, the city attorney said he would look into it. Asking for an update on Wednesday, Klein's office said it was still checking.

Separate from Klein's lawsuit against Goodwolf, the City of Columbus is also facing two class-action lawsuits brought forward by local police and firefighters. At least one anonymous plaintiff is an undercover officer, whose attorneys wrote now fears his cover has been blown.