# Columbia, SC City Services Offline After Ransomware Attack

- URL: https://usa-24.com/columbia-sc-ransomware-attack/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-26T02:25:55.626Z
- Updated: 2026-10-26T02:25:55.635Z
- Topics: Ransomware, Municipal Government, Cybersecurity, Columbia South Carolina, Data Breach

> Columbia, South Carolina, confirmed a ransomware attack that has kept MyColaSC and Animal Services payments offline. The city has not said when services return or what data was involved.

## Key takeaways

- The City of Columbia, South Carolina, confirmed on Friday, October 23, that a ransomware attack caused the outages, which were first spotted on October 20.
- MyColaSC, GIS tools, parks and recreation reservations and Animal Services payments were still offline as of October 25, and the city has not given a restoration date.
- Police, fire, 911 communications, Columbia Water and the city Payment Center are still operating.
- The city says sensitive data was on its network, and its investigation is still working to determine whether personal information was accessed.
- Residents can call 803-545-3300 for non-emergency service requests while MyColaSC is down.

Columbia, South Carolina, has spent most of a week with several of its online services switched off. On Friday night, October 23, City Manager Teresa Wilson confirmed in a Facebook video that the city is a ransomware victim. The Columbia SC ransomware attack has kept MyColaSC, parks reservations and Animal Services payments offline, and the city has not said when they will return.

The city's IT department spotted suspicious activity on October 20 and contacted the South Carolina Law Enforcement Division, known as SLED, the same day, according to the [city's official update](https://columbiasc.gov/city-of-columbia-provides-update-on-cybersecurity-incident/). Local outlets, including [WIS](https://www.wistv.com/2026/10/23/its-scary-concerns-grow-over-columbia-security-breach/), [WACH](https://wach.com/news/local/2026-10-24-city-of-columbia-confirms-ransomware-attack-disrupting-online-services-sled-investigation-cybersecurity-fbi) and [South Carolina Public Radio](https://www.southcarolinapublicradio.org/sc-news/2026-10-25/city-of-columbia-says-it-was-victim-of-ransomware-attack-asks-sled-to-investigate), reported the confirmation between October 23 and 25.

## What the city has confirmed

The city's statement is short. It says the City of Columbia "can confirm it is a victim of a ransomware attack," and it adds that the incident involved sensitive data on the city's network. Coverage so far does not say what kind of data was involved or whether any of it left the city's systems.

In her Friday video, Wilson said the city was working with SLED to contain the attack, according to [WIS](https://www.wistv.com/2026/10/23/its-scary-concerns-grow-over-columbia-security-breach/). None of the reporting names the ransomware group behind the attack, and no leak-site listing for Columbia had surfaced by the time of publication. Without a group name, outside researchers cannot easily check what that group has done elsewhere.

## Which Columbia services are offline

The city says it took the affected applications offline on purpose to limit damage. Based on reports from [Yahoo News](https://www.yahoo.com/news/articles/city-columbia-confirms-ransomware-attack-013540190.html) and [Here Columbia](https://www.herecolumbia.com/2026/10/24/city-of-columbia-confirms-ransomware-attack-services-offline/), the status of the main systems as of October 25 looks like this:

| Service | Status as of October 25 |
|---|---|
| MyColaSC resident request app | Offline |
| Geographic Information Systems tools | Offline |
| Parks and recreation reservations | Offline |
| Animal Services payments | Offline |
| Police, fire and 911 communications | Operating |
| Columbia Water | Operating |
| City Payment Center | Operating |

Animal Services had its own disruption. The department shut down temporarily on Wednesday, October 21, after the network outage hit the shelter management software it relies on. Its online payment options remain unavailable.

## Who is investigating and what is still unknown

SLED is running the criminal investigation. Wilson said the state agency may bring in the FBI, and WACH reports that the federal bureau may also get involved. The reporting does not confirm that the FBI has formally joined the case.

The most important open question is whether anyone's personal information was accessed or taken. The city says its investigation is still working on that question. The stakes are real because the city has already confirmed sensitive data sat on the network. Anyone who held a city online account, paid a fee or registered for a city service could be affected, and the city has not said which groups of people, if any, fall into that category.

The initial access route is also unknown. Cyware's October 24 threat briefing describes ransomware groups exploiting a PAN-OS GlobalProtect authentication bypass, tracked as CVE-2026-0257, to reach VPN access and move laterally across sectors including government. No public report ties Columbia's intrusion to that flaw, and stolen credentials or other routes remain possible.

The case also belongs to a longer run of public-sector data incidents. A breach at ETS may have exposed about 7 million California students, and it is a reminder that an outage and a data exposure are not always the same event. Residents should not assume that a restored service means their data is safe, or that a stalled service means it was taken.

## What Columbia residents should do now

- Call 803-545-3300 for non-emergency service requests while MyColaSC is down, according to [WACH](https://wach.com/news/local/2026-10-24-city-of-columbia-confirms-ransomware-attack-disrupting-online-services-sled-investigation-cybersecurity-fbi).
- Call 911 for emergencies. Police, fire and 911 communications are operating.
- Watch for official city notices if you paid city fees or registered for city services in the past year. The city has not yet said whether personal data was accessed.
- If you receive a breach notice, consider placing a credit freeze. Freezes are free and can be placed with Equifax, Experian and TransUnion.
- Treat unexpected emails, texts or calls about city bills, refunds or account problems with caution. Confirm them using the phone number listed on the city's official website.

## How this compares with the Ahold Delhaize outage

The closest recent parallel is the cyber outage at Ahold Delhaize's US grocery brands. The company confirmed that malicious actions were behind the disruptions, which hit Food Lion, Stop & Shop, Giant and Hannaford, according to [The Record](https://therecord.media/ahold-delhaize-cyberattack-grocery). Ahold said its stores stayed open and that it found no evidence customer data was taken.

Ahold restored digital services for its US banner on October 20, after an outage that began around October 11 or 12, according to [Progressive Grocer](https://progressivegrocer.com/ahold-delhaize-usa-restores-online-grocery-services-after-cyberattack). That was roughly eight to nine days of disruption.

Two differences stand out. The grocer's case involved no confirmed data theft, while Columbia's city has confirmed sensitive data on its network and has not resolved what happened to it. Columbia is also a government whose residents cannot easily move to another provider for permits, payments or animal services, which raises the stakes of a long outage. On day five, Columbia has no restoration date at all.

## What IT teams should take from Columbia's case

Municipal cases like this one show why offline backups and tested recovery plans matter, according to the [Carolina Courier](https://carolinacourier.substack.com/p/the-city-of-columbia-sc-acknowledges). Backups that sit on the same network as production systems can be encrypted along with them, which turns a service outage into a long recovery project.

Organizations should also review VPN and remote access appliances, apply vendor patches quickly, require multifactor authentication for remote logins and segment networks so one compromised system cannot reach shared services. Those steps will not stop every attack, but they limit how far an intruder can move.

Ransomware remains active across sectors. The FBI and CISA have warned about [SafePay ransomware](https://usa-24.com/safepay-ransomware-advisory-fbi-cisa/), which has hit more than 600 victims, and that warning is a reminder that groups keep targeting organizations of all sizes.

## What to watch next

Three developments will shape how this story reads over the coming days. The first is whether the city says what sensitive data was involved and whether any residents' information was taken. The second is whether SLED brings in the FBI, which would signal a broader federal investigation. The third is when MyColaSC, the GIS tools, parks reservations and Animal Services payments come back online.

The city's next update will matter more than its first. If officials can explain clearly what data was touched and give residents a timeline for MyColaSC, the response will look measured. If the services stay dark and the questions go unanswered, residents will have far more reason to worry about what was taken.

## Frequently asked questions

### Did Columbia, South Carolina, confirm a ransomware attack?

Yes. City Manager Teresa Wilson confirmed in a Facebook video on Friday, October 23, and the city's official update says it "can confirm it is a victim of a ransomware attack." The city's IT department first spotted suspicious activity on October 20.

### Which Columbia city services are down after the ransomware attack?

As of October 25, MyColaSC, GIS tools, parks and recreation reservations and Animal Services payments were offline. Police, fire, 911 communications, Columbia Water and the city Payment Center were still operating. The city has not given a date for restoring the affected services.

### Was my personal information stolen in the Columbia ransomware attack?

That has not been confirmed. The city says the incident involved sensitive data on its network, and its investigation is still working to determine whether personal information was accessed or taken. Residents who paid city fees or registered for city services should watch for official notices.

### How do I get help from Columbia while city services are offline?

Residents can call 803-545-3300 for non-emergency service requests while MyColaSC is down. For emergencies, call 911, since police, fire and 911 communications are running. The city has not said when online payments and other services will return.

### Who is investigating the Columbia ransomware attack?

The South Carolina Law Enforcement Division, known as SLED, is running the criminal investigation. City Manager Teresa Wilson said the state agency may bring in the FBI, and WACH reports the federal bureau may also get involved. No ransomware group has been publicly named in the reporting so far.

## Sources

1. [Columbia city manager confirms ransomware attack behind service outages — WIS](https://www.wistv.com/2026/10/23/its-scary-concerns-grow-over-columbia-security-breach/)
2. [City of Columbia Provides Update on Cybersecurity Incident — City of Columbia, SC](https://columbiasc.gov/city-of-columbia-provides-update-on-cybersecurity-incident/)
3. [City of Columbia confirms ransomware attack disrupting online services — WACH](https://wach.com/news/local/2026-10-24-city-of-columbia-confirms-ransomware-attack-disrupting-online-services-sled-investigation-cybersecurity-fbi)
4. [City of Columbia confirms ransomware attack, several online services remain unavailable — Yahoo News](https://www.yahoo.com/news/articles/city-columbia-confirms-ransomware-attack-013540190.html)
5. [City of Columbia says it was victim of ransomware attack, asks SLED to investigate — South Carolina Public Radio](https://www.southcarolinapublicradio.org/sc-news/2026-10-25/city-of-columbia-says-it-was-victim-of-ransomware-attack-asks-sled-to-investigate)
6. [City of Columbia Confirms Ransomware Attack on Its Network — Here Columbia](https://www.herecolumbia.com/2026/10/24/city-of-columbia-confirms-ransomware-attack-services-offline/)
7. [Columbia, SC Acknowledges Ransomware Attack — The Carolina Courier](https://carolinacourier.substack.com/p/the-city-of-columbia-sc-acknowledges)
8. [Cyware Daily Threat Intelligence - October 24, 2026 — Cyware](https://www.cyware.com/resources/threat-briefings/daily-threat-briefing/cyware-daily-threat-intelligence-october-24-2026)
9. [Ahold Delhaize confirms 'malicious actions' behind cyber outages affecting grocery brands — The Record](https://therecord.media/ahold-delhaize-cyberattack-grocery)
10. [Ahold Delhaize USA Restores Online Grocery Services After Cyberattack — Progressive Grocer](https://progressivegrocer.com/ahold-delhaize-usa-restores-online-grocery-services-after-cyberattack)