Connect with us

Hi, what are you looking for?


Data Breaches

Ohio History Organization Says Personal Information Stolen in Ransomware Attack

Personal information stolen in ransomware attack at Ohio History Connection posted online after organization refuses to pay ransom.

Ohio History Connection (OHC) has confirmed that personal information of thousands of individuals was stolen in a July ransomware attack and later posted online.

A nonprofit organization, OHC manages the Ohio History Center, the primary museum for Ohio’s history, as well as 50 museums and sites across the state. The organization is headquartered in Columbus, where the Ohio History Center is located.

In a data breach notice, the organization announced that data on its internal servers was encrypted and stolen in a ransomware attack in July.

The attackers, OHC says, threatened to post the stolen information online, demanding millions of dollars to be paid as ransom.

“OHC made an offer to the cybercriminals to prevent the release of the data. On August 7, the cybercriminals rejected the offer. The personal information of certain stakeholders may now be accessible to those who may be looking for it,” the organization says.

The compromised information includes the names, addresses, and Social Security numbers of current and former employees (spanning between 2009 and 2023), along with the names and Social Security numbers of third-party vendors providing services to the organization.

“They also may have gained access to images of checks provided to OHC by some members and donors beginning in 2020,” OHC says. No credit card information was compromised.

Advertisement. Scroll to continue reading.

The organization estimates that roughly 7,600 individuals might have been affected by the incident.

OHC says it has reported the attack to the relevant authorities and has retained an IT consulting firm to help with the investigation.

The organization also says it has moved most of its data to cloud-based services and has implemented new security systems to better protect its data.

“At this time, there is no evidence that there has been any use or attempted use of the information exposed in this incident,” OHC says.

However, personally identifiable information posted online often ends up being used in various types of attacks, including phishing.

SecurityWeek has checked the leak websites of several major ransomware groups and found that the LockBit group took credit for the attack on OHC in late July. 

Related: Cybersecurity Companies Report Surge in Ransomware Attacks

Related: Ransomware Group Starts Leaking Data From Japanese Watchmaking Giant Seiko

Related: 1.5 Million Impacted by Ransomware Attack at Canadian Dental Service

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...


A SaaS ransomware attack against a company’s Sharepoint Online was done without using a compromised endpoint.


Several major organizations are confirming impact from the latest zero-day exploits hitting Fortra's GoAnywhere software.

Data Breaches

A group of hackers has leaked Atlassian employee records and floorplans, information that was obtained from third-party workplace platform Envoy.