Short answer
The City of Columbia, South Carolina said suspicious activity found on 20 October 2026 was a ransomware attack that disrupted several online services, including the MyColaSC portal. The city says police, fire, 911, Columbia Water and its Payment Center kept working. The State Law Enforcement Division is investigating.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | City of Columbia, South Carolina |
|---|---|
| Incident type | Ransomware |
| Status | Confirmed by the organization |
| Sector | Municipal government |
| Country | United States |
| Detected | 2026-10-20 |
| Disclosed | 2026-10-21 |
| People or records affected | A city of about 150,000 residents. The city has not said whether personal data was taken |
What data was exposed
- No confirmed data theft. The city says specialists are working out whether sensitive information was accessed or compromised
- The city has said the incident involved sensitive data on its network, according to WACH
What happened
The City of Columbia, South Carolina, the state capital with about 150,000 residents, said its IT department noticed suspicious activity on Tuesday 20 October 2026 and contacted the State Law Enforcement Division (SLED). The Record reported the disruption on 22 October. At that point the city did not say whether it was ransomware, and no group had claimed it.
On 24 October WACH (ABC News 4) reported that the city had confirmed the incident was “a ransomware attack that disrupted several online services” and involved sensitive data on the city’s network.
What was disrupted
The city listed these services as affected:
- MyColaSC, which residents use to report problems and reach other city services. The Record described it as also used to pay utility bills, though the city says the Payment Center, including online payments, is operating.
- Geographic information systems (GIS)
- Animal Services
- Parks and recreation reservations
While MyColaSC was down, residents were asked to call 803-545-3300 to report potholes, fallen trees and broken streetlights. The city said it has adopted different procedures to keep services moving.
What kept running
The city says police, fire, 911 communications, Columbia Water systems and the Payment Center were operating as “essential services.” It said it wanted to reassure residents that critical public safety and utility systems remain operational.
What is not known
Officials have not confirmed whether sensitive information was accessed or compromised, and they have not said what kind of data sits on the affected network. Comparitech’s October ransomware roundup lists the Qilin group as claiming the attack, but this is an attacker claim, and the city has not confirmed any attribution. The Record noted that South Carolina had seen other public-sector incidents recently, including Spartanburg County and the AnMed hospital system, and that neither the city nor SLED had said whether they are linked.
What residents should do
For now the main risk is bill-payment fraud. When a city portal goes down, scammers send fake utility or fine notices with a look-alike payment link. Pay only through the city’s official site, which you type yourself, and ignore any threat of a water shutoff that demands instant payment. Our guide to utility and energy bill scams covers the shutoff-threat script, and the guide to government impersonation scams covers fake city notices.
If the city later says personal data was taken, follow our data breach checklist and learn to recognise phishing messages.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake 'City of Columbia' texts or emails about an unpaid water bill or parking fine that point to a look-alike payment page.
- Callers who say your utility account was affected and ask for card details to 'restore' it.
- Phishing messages that mention the incident to ask residents to confirm personal details.
- Scam threats that your water will be shut off unless you pay immediately.
What to do if you are affected
- 01Pay city bills only through the city's official channels. Type the address yourself rather than using a link in a message.
- 02To report non-emergency issues while MyColaSC is affected, use the city's phone line, 803-545-3300, as the city advised.
- 03Ignore any message that threatens a water shutoff and demands payment by gift card, crypto or a payment link.
- 04Watch your mail and email for a notice from the city. If the city confirms personal data was taken, follow the steps in its letter.
- 05If you gave details to a suspicious message, change that password and contact your bank.
Frequently asked questions
What services were affected in Columbia?
The city named MyColaSC, the platform residents use to report problems and access city services, plus Animal Services, parks and recreation reservations and its geographic information systems. Police, fire, 911 communications, Columbia Water and the Payment Center were reported to be operating.
Was personal data stolen?
Not confirmed. WACH reported on 24 October that officials had not confirmed whether sensitive information was compromised, and that cybersecurity specialists were investigating. The city had not named a group at that point.
Which group is behind it?
The city has not named one. Comparitech's October roundup lists the Qilin ransomware group as claiming the attack. That is an attacker claim, and the city and SLED had not confirmed it in the sources reviewed.
Who is investigating?
The State Law Enforcement Division (SLED) is leading the investigation and may work with the FBI and other agencies, per WACH. SLED declined to comment when The Record first reported the incident.
Sources
- South Carolina officials offer assistance after cyber incident in Columbia, The Record from Recorded Future News, 2026-10-22
- City of Columbia confirms ransomware attack disrupting online services, WACH (ABC News 4), 2026-10-24
- Ransomware roundup: October 2026, Comparitech
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.