On August 02, 2023, the karakurt ransomware group listed COSI — Columbus, Ohio’s Center of Science and Industry — on its leak site, announcing that it had taken approximately 75 GB of internal data. The museum, which serves thousands of families, students, and donors each year, now faces public exposure of projects, financial records, contracts, client contacts, donation details, databases of clients, partners, employees, transactions, and correspondence. The group warned that further release was imminent.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Cosi
Get alerted the next time Cosi files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Cosi’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Reported Details from the Listing
The karakurt leak site states that it exfiltrated the data during a ransomware attack. It lists specific categories including project information, accounting and financial documents, confidential contracts, client and donation records, employee databases, transaction logs, and internal correspondence. The disclosure does not quantify the number of individuals whose records were taken, nor does it specify exact file types beyond the broad descriptions provided. The listing remains active and includes a countdown-style warning that the data will be published if demands are not met.
Why This Matters for You and Your Family
If you or your children have visited COSI, attended an event, participated in a program, made a donation, or been listed as an employee, contractor, or partner, your information may be among the records now held by the attackers. Client contacts, employee data, donation records, and correspondence often contain names, addresses, phone numbers, email addresses, and financial details that criminals can use for identity theft, phishing, or targeted scams. Families who trusted the museum with personal or payment information now risk that data appearing on dark-web markets or being used to impersonate them.
The Doxxing and Identity-Chain Risk
Once internal files and databases leave an organization’s control, attackers and subsequent buyers can link seemingly harmless details into full identity profiles. A museum donor record might connect your name and address to an email address used on a child’s gaming account; an employee spreadsheet can tie work details to family members listed as emergency contacts. These chains allow doxxing that escalates from leaked data to harassment, account takeovers, or physical security threats. Credential leaks of this nature frequently cascade into gaming platforms, where children’s accounts become entry points for further compromise.