Columbia confirms ransomware attack, SLED investigates

Update October 31, 2026: The report adds two new developments. In Columbia, BreachNews said Qilin allegedly added the city to its leak site on October 29, although authorship and any exfiltration remain unverified. Bernalillo, New Mexico, also approved an $82,000 offer to the attackers in an attempt to resolve its own ransomware case, without confirming that the payment was made.

The city of Columbia, South Carolina, confirmed on October 23, 2026, that it had suffered a ransomware attack first detected on October 20. The incident affected several online public services, and the South Carolina Law Enforcement Division, or SLED, opened a criminal investigation. Based on the reporting available, police, fire services, the 911 system, Columbia Water and the payment center were still operating.

What services were affected?

The disruption reached the MyColaSC platform, which is used to pay utility bills, report nonurgent incidents and access other city services. Geographic Information Systems and Animal Services systems were also affected, according to Recorded Future News and WLTX.

WLTX added that Parks and Recreation reservations were also impacted, while the city worked to determine which systems had been compromised and how broad the outage was. The Post and Courier also reported that the city had not publicly specified what sensitive information, if any, had been targeted or obtained.

What did authorities say?

The city was working with SLED to contain the attack and determine whether information had been exposed, according to WIS-TV. In that report, the FBI said it was aware of the incident but was not involved in the investigation at that time.

Columbia’s public confirmation came on October 23, after the attack was detected on October 20. By October 26, reporting still showed that several online public services remained affected, although emergency functions and essential payment services were still operating.

Columbia also said it had proactively taken down affected applications to contain the incident and support the investigation and recovery effort. Public services still affected included MyColaSC, Animal Services, Parks and Recreation reservations and GIS services.

SLED confirmed that the incident was a ransomware attack and was leading the criminal probe; the city said it was assessing which systems and information may have been accessed or compromised. Columbia also said its departments had created alternate procedures to keep nearly all municipal services available while recovery and the investigation continued.

What is known about data and extortion?

So far, the sources do not publicly confirm any data theft or ransom payment. The Post and Courier said the city had not reported what sensitive information, if any, had been targeted or obtained, and had not confirmed exfiltration.

That lack of confirmation leaves the full scope of the incident unclear, even as authorities have acknowledged that it was a ransomware attack and that SLED is continuing a criminal investigation.

What happened in Bernalillo?

Bernalillo, New Mexico, approved an $82,000 offer to the attackers in an effort to resolve its own ransomware attack, but the report said the deal did not guarantee system recovery. Municipal officials also said they had not made the payment yet and had no timeline for returning to normal operations.

Although most of Bernalillo’s services had come back online, residents still could not pay water bills online and had to do so in person or by mail.