Columbia, SC Confirms Ransomware Attack Hit Four City Online Services

The City of Columbia, South Carolina, says it is the victim of a ransomware attack that hit several public-facing services and “involved sensitive data within the City’s network”. In an update on its website posted at 01:20 GMT on Saturday 24 October, or 9.20pm on Friday local time, the city said the incident was discovered on 20 October and that its IT department “immediately contacted the South Carolina Law Enforcement Division (SLED)”.

“As the ongoing criminal investigation continues, the City of Columbia can confirm it is a victim of a ransomware attack,” the city said. City Manager Teresa Wilson gave the same account in a video on the city’s YouTube channel, posted minutes earlier, and on Facebook. The city has not said whether any information was taken. Columbia is the state capital and has about 150,000 residents, according to The Record.

What is down and what is still running

The city says affected applications “were taken offline as a precautionary measure”. Those include MyColaSC, the platform residents use to pay utility bills and report problems, along with online services for Animal Services, Parks and Recreation reservations and the city’s geographic information system (GIS). Residents are being asked to report issues such as potholes and broken streetlights by phone while MyColaSC is unavailable.

Core services are still working, according to the city. It lists the Columbia Police Department, Columbia-Richland Fire Department, 911 communications, Columbia Water systems and the Payment Center, including online payments, as operational. It says business continuity measures are in place in the affected departments.

The disruption has reached inside City Hall too. Animal Services had a temporary shutdown on Wednesday because of problems with the city’s network and its shelter management software, WIS reported. A city employee who asked not to be named told WIS that staff had been unable to clock in and out. WIS said there is no timeline for restoring the affected services.

SLED is leading the investigation

The city says it is “working methodically with SLED and cybersecurity specialists to contain the attack, identify affected systems, assess the extent of any information that may have been accessed or compromised, and restore impacted services”. It added that SLED “may work collaboratively with the Federal Bureau of Investigation (FBI), and other state and federal partners”, and that it has “reached out to highly qualified third-party cybersecurity professionals”.

As of 23 October, the FBI told WIS it was aware of the breach but not involved, and a SLED spokesperson said the agency had no additional information to share. Two days earlier, the city had not answered The Record’s questions about whether it was dealing with ransomware, and SLED declined to comment. No hacking group had claimed the attack as of Wednesday, The Record reported, and none of the reports names one.

“The City of Columbia understands the importance of protecting the information entrusted to us and recognizes that residents, businesses, and employees may have questions or concerns about this incident,” Wilson said in the video, according to WIS. She said the city would give further updates on restoration, protective measures and “any identified impacts to information”.

Columbia is one of several local governments hit this month

The Record noted that South Carolina has dealt with a ransomware attack on Spartanburg County before, and that a recent incident shut down systems at the hospital group AnMed. It said cities and counties in Maryland, New Mexico, Utah, Texas, Nebraska, Missouri, Alaska and Arizona have all had outages from cyberattacks and ransomware over the past three weeks.

In its own statement, the city cited the FBI’s Internet Crime Complaint Center (IC3), saying “more than 3,600 ransomware complaints were reported in 2025”. The city added that the figures “reflect reported complaints” and are not a count of every ransomware incident in the country.

Public bodies elsewhere are working through similar incidents. In India, Telangana’s TG-iPASS approvals portal has been down since 22 October after suspected ransomware encrypted its database. In the US, Quest Diagnostics said an unauthorised party accessed patient records through one of its systems. Earlier this month, the FBI, CISA and UK police warned that the SafePay gang had hit at least 600 victims.

The city has named the attack but not its reach

Columbia’s statement moved quickly from caution to a clear label. On 22 October it would not say whether this was ransomware. By the evening of 23 October it had confirmed it, and said the incident “involved sensitive data”. That phrase is doing a lot of work. It confirms that sensitive information sat on the affected network, but it stops short of saying any of it was copied or viewed. The city’s own list of tasks still includes assessing “the extent of any information that may have been accessed or compromised”, so that question is open. Keeping police, fire, 911, water and payments running suggests the damage was contained to a set of resident-facing applications, though the city has not explained how.

Residents will want to know what was on the network

For the people who use MyColaSC to pay bills and report problems, the outage is the visible part of the story. The harder part is the data. Wilson’s video speaks to residents, businesses and employees, which shows the city knows all three groups may be affected. Its promise of updates on “any identified impacts to information” is the one to watch, because that is where any notice to people whose details were exposed would start. Until then, the city’s account covers what is down and who is investigating, but not what the attackers may have.

TSN follows these incidents on its ransomware and cyber attacks hub. Columbia’s next update needs to say whether that sensitive data left the city’s network.

Sources

• City of Columbia: City of Columbia Provides Update on Cybersecurity Incident, 23 October 2026
• City of Columbia on YouTube: City Manager Teresa Wilson Provides Update on Cybersecurity Incident, 23 October 2026
• WIS: Columbia city manager confirms ransomware attack behind service outages, 23 October 2026
• The Record: South Carolina officials offer assistance after state capital hit with cyberattack, 22 October 2026

Related stories

• TG-iPASS Portal Down Since 22 October After Suspected Ransomware
• Quest Diagnostics Says Unauthorised Party Accessed Patient Records
• SafePay Ransomware Has Hit at Least 600 Victims, FBI, CISA and UK Police Warn
• Ransomware and Major Cyber Attacks: TSN Story Hub