The City of Columbia, the capital of South Carolina with about 150,000 residents (The Record), has confirmed that a ransomware attack caused an outage of several of its online services. The city found the intrusion on October 20, 2026. In an October 23 update it said it "can confirm it is a victim of a ransomware attack." The South Carolina Law Enforcement Division (SLED) is leading a criminal investigation, and third-party cybersecurity specialists are helping. The city says four public-facing services are affected: MyColaSC, Animal Services online services, Parks and Recreation reservations, and Geographic Information Systems (GIS). It also says the incident "involved sensitive data within the City's network" but has not said whether any of that data was accessed or stolen. As of October 22, no ransomware group had claimed the attack (The Record).
What Happened
Timeline as reported across sources:
- Tuesday, October 20: The city's Information Technology Department spotted suspicious activity on the network and contacted SLED right away (city update; WIS; WLTX).
- October 21: A city news release, reported by The Post and Courier, called the event "suspicious activity" and a "security incident" without naming ransomware. When a reporter tested the GIS website around 8:30 a.m., it did not load properly.
- October 22: A city spokesperson told The Record that SLED was leading the investigation. The city did not answer questions about whether the attack was ransomware. SLED declined to comment and sent questions back to the city.
- Wednesday, October 21 or 22 (WIS): Animal Services temporarily closed after disruptions to the city network and its shelter management software. The city had hoped to reopen the shelter at noon Friday.
- October 23: The city's official update confirmed ransomware. City Manager Teresa Wilson repeated the confirmation in a Facebook video (WIS).
- October 24: Coladaily reported that some customer-facing applications were still offline as of Saturday.
Who confirmed it is reported differently. The city's own update presents the ransomware finding as the city's confirmation, made "as the ongoing criminal investigation continues." Coladaily credits the finding to SLED's investigation. These accounts can both be true, but no SLED statement appears in the sources, and SLED declined comment to The Record.
The list of affected services changed over time.
- The city's October 23 update, repeated by WLTX and Coladaily, names four affected services: MyColaSC, Animal Services online services, Parks and Recreation reservations, and GIS.
- The city's earlier October 21 release, as reported by The Post and Courier, also listed Business Licensing and Planning and Development Services. Those two do not appear in the October 23 update. That could mean they were restored or that the scope was revised; the city has not said which.
- WIS describes the Animal Services outage as payment services specifically.
- TMC Insight states that "the available information does not identify which City of Columbia services were affected." The city's own published list contradicts this, so we give that claim no weight.
What MyColaSC does is also described differently. The Record calls it the platform residents use to pay utility bills and report non-emergency issues. The Post and Courier calls it the city's online code-enforcement violation reporting system. The city says its Payment Center, including online payments, is still working, which suggests utility payments are not affected however MyColaSC is described. Residents are being asked to call (803) 545-3300 to report potholes, fallen trees, broken streetlights and similar problems.
What is not affected: The city says the Columbia Police Department, Columbia-Richland Fire Department, 911 communications, Columbia Water systems and the Payment Center are all operational. Affected applications were taken offline on purpose as a "precautionary measure" to contain the attack, and the city has put business continuity procedures in place in the affected departments. The public sources do not say which systems were actually encrypted and which were simply shut down as a precaution.
What Was Taken
Unknown. The city's wording is that the incident "involved sensitive data within the City's network." It is still working to "assess the extent of any information that may have been accessed or compromised." No source reports that data was taken out of the network, and none gives a record count, the types of data, or a list of affected people.
Several things are also missing from the public record:
- No group had claimed the attack as of October 22 (The Record). We have seen no later claim in the sources.
- No ransom demand has been disclosed.
- No breach notification has been issued.
Most current ransomware operations steal data before they encrypt it, and the city has already said sensitive data was involved. Defenders and residents should therefore expect that data theft is possible until the forensic work shows otherwise. If a group posts Columbia on a leak site, that would be the first outside sign of what was taken.
Why It Matters
This is a state capital, not a small town. The Record reports that Columbia is one of the largest municipalities hit in recent weeks. In the same period, smaller local governments in Maryland, New Mexico, Utah, Texas, Nebraska, Missouri, Alaska and Arizona have also had service outages. Within South Carolina, Spartanburg County was hit by ransomware earlier, and a recent incident shut down the systems of the AnMed hospital system.
Containment so far appears to have worked. The attack did not reach police, fire, 911, water or payment systems. That points to either real separation between those systems and the city's administrative IT, or a fast decision to isolate systems. Either way, the city's core functions kept running. For other municipalities, that separation is the outcome to aim for.
The way the city disclosed this has drawn scrutiny. For three days the city called the event "suspicious activity" and would not say whether it was ransomware, before confirming it on October 23. This is common in early incident response, and TMC Insight notes that disclosure often lags because investigators need to preserve evidence. It also left residents unsure what was happening; WIS quoted one resident saying, "It's scary."
The sector trend. TMC Insight cites Zscaler ThreatLabz figures showing government ransomware incidents rising from 95 (April 2023 to April 2024) to 322 (April 2024 to April 2025). It also cites Verizon's 2025 data, which found ransomware in 30% of public-sector breaches. Those figures come from one secondary source, but they match the pattern The Record describes.
The Attack Technique
The initial access vector has not been disclosed. No source names the ransomware strain, the group behind it, or how the attackers got in. TMC Insight also notes that the city has not disclosed which systems were compromised or how access was obtained.
What we can infer from the outage pattern:
- The affected systems are citizen-facing, internet-reachable applications such as service request portals, reservation systems and GIS, plus back-office software like shelter management. These are the systems most often hosted on shared municipal application servers or run by outside vendors.
- The city detected the attack itself. Its own IT team spotted "suspicious activity," as opposed to a third party or the attacker announcing it. That suggests the city had some network monitoring in place.
- Some outages were the city's own choice. The city says it took affected applications offline as a precaution, so at least part of the outage was a containment decision rather than encryption.
Common entry points for municipal ransomware in the current threat landscape include edge VPN and firewall vulnerabilities, stolen credentials on remote access services without MFA, and exposed vendor-managed applications. None of these has been confirmed for Columbia.
What Organizations Should Do
- Separate public safety and utility systems from administrative IT. Columbia's 911, police, fire and water systems stayed up. Check that your own networks, identity systems and remote access paths actually keep critical operations apart from general city IT.
- Inventory and harden internet-facing citizen portals. Service request platforms, reservation systems, GIS servers and vendor-hosted applications should be patched, protected with MFA, monitored, and logically separated from internal file shares and directory services.
- Watch for the early signs of an intrusion. Columbia caught "suspicious activity" before the outage spread. Alert on lateral movement, mass credential use, new admin accounts and backup tampering, and make sure someone is responsible for responding at all hours.
- Plan offline fallbacks before an attack. Phone lines (Columbia's 803-545-3300), paper workflows for shelters and permitting, and manual booking for parks should be written down and rehearsed ahead of time, not improvised during an outage.
- Plan as if data theft has happened. When sensitive data is involved, start legal, notification and monitoring preparations early, and watch leak sites for your organization's name. Waiting for forensic confirmation adds weeks of delay.
- Agree on public messaging in advance. Decide with law enforcement ahead of time what can be said publicly and when. A clear early statement such as "We are investigating a ransomware incident; here is what still works" gives residents more certainty than days of vague wording.
Sources: Columbia Ransomware Attack: 4 City Services Down 2026 | South Carolina officials offer assistance after state capital hit w... | City of Columbia Provides Update on Cybersecurity Incident - City o... | City of Columbia confirms ransomware attack, several online service... | Columbia city manager confirms ransomware attack behind service out... | SLED investigating security of online Columbia services | SLED: Columbia cybersecurity incident was ransomware attack Commun... | Columbia Investigates Ransomware Attack With SLED TMC Insight