Child information part of Columbus data leak

COLUMBUS, Ohio (WCMH) -- NBC4 Investigates has confirmed the private information of children has been compromised as part of the ransomware attack on Columbus. 

The children are dependents of people who’ve interacted with the city. Now, people are asking questions about how to best protect themselves and their dependents.

The cybersecurity expert, Connor Goodwolf, who first helped NBC4 Investigates expose the extent of the breach, can no longer share what city data is on the dark web because the city is suing him. However, the legal actions against him don’t stop anyone else.

Other sources across the United States shared with NBC4 that forms saved on a city employee's computer, profile or virtual desktop were likely grabbed in the attack.

Watch: Expert says children's information was part of Columbus data leak

At least two tax forms of local people that list their dependents were visible, and are now on the dark web. If a city employee listed their child as a beneficiary, their social security number is at risk.

So, how can you protect your child’s credit? NBC4 took that question to an expert at TransUnion, one of the three credit bureaus.

"Your data identity is an essential asset for your entire life," TransUnion Head of Consumer Credit Education Margaret Poe said. 

For an adult, freezing credit takes a few minutes online at each of the three credit bureaus, but for a child, it's more complicated.

"You don't typically think about a kid's credit because typically a minor doesn't have a credit report or credit history," Poe said. "However, it is possible for a minor to have credit history."

It could be for a straightforward reason: a guardian added a child to a credit card. Or it could not be.

"What fraudsters will do is they'll take these disparate data points, the names and the addresses, the social security number, date of birth that are not related, and they will go synthetically create these relationships," Sift Trust and Safety Architect Alexander Hall said. 

To make sure that doesn’t happen, you can make those connections yourself: add a minor to a bank account or credit card and freeze their credit.

"What you're going to do is pull together information that verifies your identity, their identity, and then your relationship, so it can be things like birth certificates, driver's license for your own identity, just to basically confirm so that when you're sending this information to us, we are confident that you are the right person to freeze that minor's credit," Poe said.

Unlike with an adult, to freeze a child’s credit, all that proof has to be sent through the mail.

"For people who are feeling vulnerable because their information was compromised and that's why they're doing this, why is the mail-in aspect needed in this? Is there any way to do this in person?" NBC4 Investigates asked. 

"No, I don't believe there's a way to do it in person," Poe said. "The mail-in aspect is just because of the additional levels of documentation that we require for this process."

Each of the credit bureaus has details on how to do this and a number to call if you need help. For TransUnion, that information can be found here. For Experian, it is here, and for Equifax, it is here. 

The city is offering free credit monitoring for two years through Experian. As of Oct. 3, the most recent numbers for those who have signed up are: 

Employees	2,863
Residents	12,661
Minors	288

You have until Nov. 29 to sign up. 

The city's Department of Technology is also still working to get the impacted city systems back online. As of Oct. 3, the city sent a statement saying, "72% of the city’s 441 technology systems are fully restored and 5% are partially restored. The department’s goal is to have all systems restored by the end of October."