The City of Columbia, South Carolina, has confirmed that it is the victim of a ransomware attack that knocked several online city services offline and involved sensitive data on the city’s network. The incident was discovered on October 20, 2026, and the city confirmed it was ransomware in an update published on October 23.
On October 29, the Qilin ransomware group allegedly added the City of Columbia to its data leak site, according to ransomware tracking services that monitor the group’s postings. The listing does not say how much data was allegedly taken or what it contains. The claim has not been verified, and the City of Columbia had not issued any public statement about it at time of publication.
What the City of Columbia has confirmed
In its October 23 update, the city said the incident “impacted several public-facing services and involved sensitive data within the City’s network.” The city’s Information Technology Department contacted the South Carolina Law Enforcement Division (SLED) right after the attack was found, and SLED is leading the criminal investigation.
The city also said SLED may work with the Federal Bureau of Investigation (FBI) and other state and federal partners to determine the origin, scope and severity of the attack. City Manager Teresa Wilson confirmed the ransomware attack in a video statement the same day and said the city “is weighing its options” and has reached out to outside cybersecurity professionals for advice on its action plan.
The city has not said what kind of sensitive data was involved, how many people could be affected, or whether any information was copied out of its network. It said it will share more details about “any identified impacts to information” as the investigation continues.
City services knocked offline
Columbia first disclosed a “security incident” in an earlier notice after its IT team spotted suspicious activity on the network. Affected applications were taken offline as a precaution. Services disrupted at different points include:
- MyColaSC, the city’s app for reporting potholes, fallen trees, broken streetlights and other local issues
- Animal Services online services, with the city shelter also briefly disrupted
- Parks and Recreation reservations
- Geographic Information Systems (GIS), including the city’s online maps
- Business Licensing and Planning and Development Services, which were listed in the first notice
As of October 28, a week after the attack, some of these services were still unavailable. Residents who would normally use MyColaSC have been asked to call (803) 545-3300 instead. City departments have set up alternative processes so most services can continue while systems are restored.
Police, fire, 911 and water still running
The city has repeatedly stressed that critical public safety and utility systems were not disrupted. The Columbia Police Department, Columbia-Richland Fire Department, 911 communications, Columbia Water systems and the city’s Payment Center, including online payments, all remain operational, according to the city.
Columbia is the capital of South Carolina and the state’s second-largest city, so a prolonged outage of public-facing systems affects a large number of residents and businesses. The city has not said when the remaining services will be back online.
Who is Qilin?
Qilin is a ransomware-as-a-service operation that has been one of the most active extortion groups over the past year. It typically steals data before encrypting systems, then threatens to publish the stolen files on its leak site if a ransom is not paid. This is known as double extortion.
The group has repeatedly targeted public sector bodies and large organizations. BreachNews has previously covered Qilin’s alleged attack on the ATF, its campaigns exploiting a PAN-OS VPN bypass, and the arrest of a suspected Qilin leader earlier this month. Despite that arrest, the group’s leak site has continued to list new alleged victims.
Local governments remain a frequent ransomware target because they run many connected systems on limited budgets and cannot easily tolerate long outages. Earlier this year, Winona County, Minnesota was hit by a second cyberattack in three months.
What residents and city employees should do
Until the city confirms what data was involved, residents, businesses and employees who have shared information with the City of Columbia should take some basic precautions:
- Be wary of calls, texts and emails that claim to be from the city and ask for payment or personal details. Contact the department directly using the numbers on the city’s contact page.
- Watch bank and credit statements for charges you do not recognize.
- Consider a credit freeze with the three major credit bureaus if you are concerned about identity theft. It is free and can be lifted at any time.
- Watch for an official notice from the city explaining whether your personal information was involved and what support is being offered.
The city said it remains committed to a “thorough, transparent and measured response” and will provide further updates on the investigation and service restoration. BreachNews will update this article if the city confirms what data was taken or responds to the Qilin claim.
