The city government of Columbus, Ohio, said a ransomware attack that stirred up a high-profile lawsuit had exposed the data of about 500,000 people.