The City of Columbia, South Carolina, confirmed on 23 October 2026 that it was hit by ransomware, three days after officials first spotted suspicious activity on 20 October. For anyone who pays a city bill online or reports problems through municipal channels, the Columbia SC ransomware attack residents are now dealing with is a practical problem as well as a security story. Here is what is known, what is not, and what you can sensibly do while the investigation continues.
What Columbia Has Confirmed So Far
The timeline is short. The city detected suspicious activity on 20 October and, by 23 October, the city manager confirmed that ransomware was behind the service outages. Local reporting describes the investigation as ongoing and notes that some city services remain operational.
That is where the confirmed picture ends. Based on the sources available, the city has not published a full account of how attackers got in, which systems were encrypted, or whether any data was copied. Be wary of precise figures or attribution circulating on social media. Criminal groups sometimes make claims that are exaggerated or unverified, and only the city and its investigators can confirm what was actually taken.
How the Outage Affects Residents' Accounts and Payments
The most visible impact is on online services. Reports say residents have been unable to use the MyColaSC platform to pay bills or report issues. Online service requests and business licensing have also been limited, according to coverage of the incident.
The city has pointed residents who would normally use MyColaSC to report potholes, fallen trees and similar problems to a phone line instead: 803-545-3300. Check the city's official website and verified social media accounts for current instructions on paying utility bills while the portal is down.
A few practical points follow from an outage like this:
- Payment timing: If you cannot pay online, keep a record of when you tried and what error you saw. This can help if a late fee or service question comes up later.
- Autopay and saved cards: If you have a recurring payment set up, check your bank or card statement for unexpected charges, failed payments or duplicates.
- Alternative channels: Use only the payment methods the city announces through its official channels. Outages are a favorite moment for scammers to send fake payment links.
Why Municipal Ransomware Often Means Data Theft Too
It is tempting to think of ransomware as a lock on the doors: systems go down, the city restores from backups, and life returns to normal. That is no longer a reliable assumption. Many modern ransomware crews copy sensitive files before they encrypt anything, then threaten to publish the data if the victim refuses to pay. Our explainer on multi-extortion ransomware and why backups aren't enough covers how this tactic works and why restoring systems does not undo a data leak.
Cities hold a wide range of personal information, which is why a municipal incident can matter even when you never visited a city office. Depending on the system, records may include names, addresses, contact details, payment account information and business license data. Whether any of that was accessed in Columbia has not been confirmed in the sources reviewed here, so the sensible stance is to prepare without assuming the worst.
What This Means For You
If you live in Columbia or do business with the city, treat this as a period for extra attention rather than alarm. The outage is real and the investigation is open, but nothing in the confirmed facts tells you that your personal data has been exposed. At the same time, a ransomware attack on a city is the kind of event that often leads to a formal breach notice later, so it pays to be ready to act on one.
The main risks to watch for in the near term are:
- Phishing and impersonation: Messages claiming to be from the city, your utility or a "payment portal" asking you to log in or pay immediately.
- Account misuse: Unexpected activity on payment methods linked to city accounts.
- Delayed fallout: If data was stolen, it can surface weeks or months after systems come back online.
What Residents Should Check and Do Now
- Use official channels only. Get updates from the city's website and verified accounts. If a message links to a payment page, go to the city's site directly instead of clicking.
- Monitor your accounts. Review utility, bank and card statements for anything unfamiliar, and set up transaction alerts if your bank offers them.
- Use unique passwords. If you reuse your city account password elsewhere, change it on the other sites, and turn on multi-factor authentication where available.
- Be skeptical of urgent requests. Real agencies rarely demand immediate payment by gift card, wire or unfamiliar app.
- Watch for a breach notice. If personal information is confirmed as exposed, you may receive a letter or email. South Carolina Consumer Affairs also maintains a public list of security breach notices received by the state.
- Consider a credit freeze if notified. If a notice says sensitive identifiers were involved, a credit freeze is a free way to make new-account fraud harder.
- Keep records. Save screenshots and receipts for any payment attempts made during the outage.
The Bottom Line
The Columbia SC ransomware attack residents are navigating is still unfolding, and much about its scope remains unconfirmed. What you can control is straightforward: monitor your utility and city payment accounts, rely on official channels, and watch for any breach notice from the city. And remember that restored systems do not guarantee your data stayed private, which is why it is worth reading our piece on why backups aren't enough against modern ransomware to understand how data exposure can remain a risk even after a city is back online.
