Columbus Division of Fire Data Breach Report

Incident Overview

The Columbus Division of Fire, a municipal emergency services agency in Columbus, Ohio, experienced a significant data breach involving unauthorized access to its network server infrastructure. The breach was reported to the U.S. Department of Health and Human Services Office for Civil Rights on February 10, 2025, affecting 736 individuals. This incident represents a compromise of protected health information (PHI) maintained by the fire department, likely collected through emergency medical services (EMS) operations, occupational health records, or employee health information systems. The unauthorized access to the network server indicates a sophisticated attack on the organization's IT infrastructure rather than a physical theft or loss of devices.

Discovery and Response Timeline

While specific details regarding the initial discovery date are not provided in the breach submission, the February 10, 2025 submission date indicates that the Columbus Division of Fire identified the breach, conducted an investigation, and determined the scope of affected individuals within a reasonable timeframe. Upon discovery of the unauthorized network access, the organization initiated standard breach response protocols including forensic investigation of the compromised server, assessment of accessed data, and notification procedures required under the Health Insurance Portability and Accountability Act (HIPAA). The organization's response likely included engagement with IT security professionals to determine the breach vector, contain the intrusion, and prevent further unauthorized access. Notification to affected individuals was required within 60 days of discovery, consistent with HIPAA Breach Notification Rule requirements.

Technical Breach Details

Network Server Compromise

The breach involved unauthorized access to a network server, which typically indicates a remote compromise rather than physical theft. Network server breaches commonly result from vulnerabilities such as unpatched software, weak authentication credentials, exposed remote access points (RDP, VPN), SQL injection attacks, or social engineering leading to credential compromise. The fact that this breach affected a municipal fire department suggests the attackers may have exploited publicly-facing systems or vulnerabilities in systems connected to the internet. Network-based breaches of this nature often go undetected for extended periods, meaning the actual compromise date may predate the discovery and notification date by weeks or months. The Columbus Division of Fire's IT infrastructure likely includes systems for emergency dispatch, patient care records, employee health information, and administrative data—all of which may have been accessible through a compromised network server depending on the organization's network segmentation and access controls.

Organizational Context

The Columbus Division of Fire is a municipal emergency services agency responsible for fire suppression, rescue operations, and emergency medical services across Columbus, Ohio's jurisdiction. As Ohio's largest city, Columbus maintains a substantial fire department with multiple stations and personnel. The organization maintains health information in multiple contexts: occupational health records for firefighters and staff, emergency medical services (EMS) patient care records, and potentially employee health insurance information. Municipal fire departments increasingly maintain electronic health records for both operational purposes and compliance with occupational safety regulations. The Columbus Division of Fire's network infrastructure supports critical emergency response operations, making cybersecurity particularly important for both operational continuity and patient privacy protection.

Impact on Affected Individuals

Number of People Affected

The breach impacted 736 individuals, a moderate-sized group that likely includes a combination of fire department employees, EMS patients, and potentially other individuals whose information was stored on the compromised network server. This number suggests the breach may have affected multiple years of records or a specific subset of the organization's database rather than a complete system compromise. The 736 affected individuals represent residents and employees of the Columbus area whose personal health information was exposed to unauthorized access.

Personal Information Involved

Based on the nature of a fire department's operations and typical network server contents, the exposed information likely includes:

• Employee Health Records: Occupational health examinations, medical clearances, fitness-for-duty evaluations, and workers' compensation information for fire department personnel
• EMS Patient Information: Names, addresses, dates of birth, phone numbers, insurance information, and medical history from emergency medical services calls
• Medical Diagnoses and Treatment Information: Details of medical conditions, medications, allergies, and emergency medical treatment provided
• Contact Information: Phone numbers, email addresses, and residential addresses
• Insurance Information: Health insurance policy numbers and carrier information
• Potentially Sensitive Identifiers: Employee identification numbers, badge numbers, or other organizational identifiers

While Social Security numbers and financial account information are not confirmed as exposed, the network server environment could potentially have contained such data depending on the organization's data storage practices.

HIPAA Compliance and Notification Requirements

As a covered entity under HIPAA (municipal health departments and fire departments providing EMS are typically covered entities), the Columbus Division of Fire is required to notify affected individuals of the breach without unreasonable delay and in no case later than 60 calendar days after discovery. The organization must also notify prominent media outlets if the breach affects more than 500 residents of a jurisdiction, and must report the breach to the HHS Office for Civil Rights. The February 10, 2025 submission date indicates compliance with HHS reporting requirements. Affected individuals should have received notification letters detailing the nature of the breach, the types of information exposed, steps the organization is taking to address the breach, and recommended actions for protecting themselves against identity theft and fraud.

Industry Context

Network server breaches represent a significant and growing threat to healthcare organizations. According to HHS breach statistics, hacking and IT incidents account for the majority of large healthcare data breaches in recent years. Municipal and public health agencies often face particular challenges in cybersecurity due to budget constraints, legacy IT infrastructure, and the critical nature of emergency services operations. The exposure of EMS patient information is particularly concerning as it combines medical sensitivity with operational details that could be exploited. Fire departments and EMS agencies have become increasingly attractive targets for cybercriminals due to the sensitive nature of their data and the potential for operational disruption.