City of Columbia, SC Suffers Ransomware Attack, Requests State Investigation
What Happened — On 25 October 2026 the municipal IT environment of Columbia, South Carolina was hit by a ransomware campaign that encrypted critical city services, including the public works scheduling system and the finance department’s file servers. The attackers demanded payment in cryptocurrency and threatened to publish sensitive citizen data. City officials detected the encryption after users reported inaccessible files, isolated the affected network segments, and immediately asked the South Carolina State Law Enforcement Division (SLED) to lead the investigation. As of the report, the city is still working to restore services from offline backups while forensic analysis is underway.
Why It Matters for Trust & Control Assurance — The incident underscores the need for robust incident‑response and recovery controls that can be demonstrated with continuous evidence.
Who Is Affected — Municipal governments, public‑sector IT providers, any organization that runs critical public services.
Recommended Actions
- Activate your incident‑response plan and involve law‑enforcement early.
- Verify the integrity of offline backups and begin a tested restoration process.
- Conduct a post‑incident control review focusing on detection, containment, and recovery procedures; map findings to your audit framework of record.
- Document all actions as evidence for future compliance audits.
Technical Notes
- Attack vector: Phishing email with a malicious attachment that dropped a Ransomware‑as‑a‑Service payload (identified as “LockBit 3.0”).
- No public CVE; the payload exploits Windows SMB v1 for lateral movement.
- Data at risk: citizen contact information, payment records, internal policy documents.
Source: South Carolina Public Radio – City of Columbia ransomware report