Columbia Ransomware Attack: 4 City Services Down [2026] - shattered.io

The City of Columbia has officially confirmed it is the victim of a ransomware attack discovered on October 20, 2026. The incident has pulled several resident-facing online services offline while the city and state investigators work through the damage. The city's update directly states, 'The City of Columbia is a victim of a ransomware attack,' marking the first public acknowledgment of the cyber incident.

Affected Services

Four named services have been impacted by the attack: MyColaSC, the city's citizen-service application; Animal Services; Parks and Recreation reservations; and the city's Geographic Information Systems (GIS). However, critical functions remain operational. The Columbia Police Department, Columbia-Richland Fire Department, 911 communications, Columbia Water systems, and the Payment Center including online payments continue to function.

Containment Measures

The city has taken affected applications offline as a containment and investigative measure. This standard practice stops the malware from spreading and preserves evidence for investigators. While this means residents lose access to certain services, the city has implemented business-continuity measures to maintain operations through manual or alternative processes.

The decision to prioritize keeping critical systems like police, fire, 911, water, and payments operational suggests the city had a prioritized list of essential functions, aligning with incident response planning recommendations.

Investigation Status

The South Carolina Law Enforcement Division (SLED) is leading the investigation with assistance from cybersecurity specialists. This state involvement follows the typical pattern of state agencies supporting local governments that lack extensive security teams. The investigation aims to identify the attackers, determine if sensitive data was accessed, and understand the attack vector.

Several key details remain unconfirmed: whether sensitive information was compromised, who is behind the attack, if a ransom was demanded, and when services will be restored. The city has not provided figures on financial losses, affected residents, or compromised systems.

The lack of public attribution means any claims about the responsible group remain speculative until investigators confirm or the attackers claim responsibility through their typical channels.

Next Steps

With affected systems isolated, the city's IT team and outside specialists can examine the compromised applications without the malware active. They must decide which systems to rebuild from clean backups and which to restore after verification. The city has not yet outlined its recovery sequence or provided a timeline for service restoration.

The investigation's outcome will determine the incident's ultimate severity, particularly regarding potential data exposure. Residents are advised to monitor official city communications for updates on service restoration and any necessary precautions regarding personal information.