Columbia SC Ransomware Attack: 6 Things Southeast Towns and Businesses Should Check This Week

When a state capital gets hit by ransomware, every town hall and small office in the Southeast should take notice. In our latest video, Jason from ADVYON walks through what the City of Columbia has confirmed and six things worth checking this week. This post covers the same ground in writing, so you can forward it to your town administrator or office manager.

What happened in the City of Columbia ransomware attack?

According to the city’s official update, the incident was discovered on October 20, 2026. The city’s IT department immediately contacted the South Carolina Law Enforcement Division (SLED) to investigate, and the city has confirmed it is the victim of a ransomware attack that “involved sensitive data within the City’s network” (City of Columbia). Local outlets reported the confirmation on Oct. 23 (WLTX, WIS).

To contain the attack, the city took affected applications offline as a precaution. As of its Nov. 3 update:

• Still running: the Columbia Police Department, Columbia-Richland Fire, 911 communications, Columbia Water and the Payment Center, including online payments.
• Taken offline: the MyColaSC app, Parks and Recreation reservations, and online maps (GIS), along with Animal Services online services.
• Back online: Animal Services online services were fully operational again on Nov. 3.

SLED’s investigation is ongoing, and the city says it will share more as information is confirmed. The city also notes that the FBI’s Internet Crime Complaint Center received more than 3,600 ransomware complaints in 2025, and that’s only the ones that were reported (City of Columbia).

Was the City of Columbia at fault?

No one outside the investigation knows yet, and the city hasn’t said how the attackers got in. What the public record does show is a city that moved quickly: it called SLED right away and kept emergency and utility services up. Ransomware hits capital cities and ten-person offices alike, so the useful question is what you can check this week.

How can a town or small business prevent ransomware? 6 things to check this week

All six come straight from the federal #StopRansomware Guide, published by CISA, the FBI, the NSA and MS-ISAC.

1. Backups that are offline and tested. Ransomware often goes after your backups first, so keep at least one copy it can’t reach, and practice restoring from it. A backup you’ve never tested is just a hope.
2. Multi-factor sign-in (MFA) everywhere. Email, remote access and especially admin accounts. A stolen password alone shouldn’t get anyone in.
3. Patched VPN and remote access. An old firewall or a remote desktop left open to the internet is a favorite way in. Update it, or close it.
4. A written incident plan, with a printed copy. Your computers may be down when you need it. Write down who’s in charge, who calls your IT team and your insurance carrier, and who calls law enforcement.
5. Regular phishing training. Short, regular practice, so a strange email gets reported, not clicked.
6. No admin rights on everyday accounts. The accounts people use every day shouldn’t be admin accounts. Use a separate admin account only when it’s needed, so if an attacker gets into someone’s account, the damage stays limited.

Why shouldn’t everyday accounts have admin rights?

Because attackers use whatever access the account they steal already has. CISA’s guide says to “separate administrator accounts from user accounts” and to “apply the principle of least privilege to all systems and services so that users only have the access they need to perform their jobs,” noting that “malicious actors often leverage privileged accounts for network-wide ransomware attacks” (CISA).

This matters most for owners and anyone in billing, finance or operations. Those are the people attackers target: the FBI warns that business email compromise scams go after employees who handle payments and impersonate executives and finance staff (FBI IC3). If one of those everyday accounts is compromised and it isn’t an admin account, the attacker can’t take over the whole network from it. The same idea applies when people leave: a good employee offboarding process removes access no one should still have.

Who should we call if we’re hit by ransomware?

Put these in your printed plan before you need them: your IT team or provider, your cyber insurance carrier, and law enforcement. That means your state’s law enforcement agency or fusion center, like SLED here in South Carolina, plus the FBI at ic3.gov. South Carolina organizations can also report an incident to SC CIC, a SLED-sponsored program. Outside South Carolina, DHS lists the fusion center for every state.

Frequently asked questions

Did the City of Columbia say how the ransomware got in?

No. As of the city’s Nov. 3, 2026 update, it hasn’t said how the attackers got in. SLED’s criminal investigation is ongoing, and the city says it will provide more updates as information is confirmed.

Which City of Columbia services were affected?

The city took the MyColaSC app, Parks and Recreation reservations, online maps (GIS) and Animal Services online services offline as a precaution. Police, fire, 911, water and the Payment Center kept running. Animal Services online services were back on Nov. 3.

What does “no admin rights on everyday accounts” mean?

Staff sign in for daily work, like email, files and the web, with a standard account. Admin rights live in a separate account that’s used only for admin tasks, only when needed. If an attacker steals someone’s everyday sign-in, they don’t get admin control with it.

Who do we report a ransomware attack to?

Call your IT team and your insurance carrier, then law enforcement: your state’s law enforcement agency or fusion center (SLED in South Carolina) and the FBI through ic3.gov.

Does ADVYON only help towns in South Carolina?

No. ADVYON is based in the Lowcountry and helps towns, counties and municipalities across the Southeast with their cybersecurity.

Want a second set of eyes on your ransomware readiness?

ADVYON has been a managed IT and cybersecurity company since 2008, with offices in Summerville and Mt Pleasant. We help towns, counties and municipalities across the Southeast, and all of our staff are SLED-checked and CJIS-certified to work with municipalities. When you call, you reach a senior tech first. See our municipal IT services and managed security services.

Book a free Discovery Meeting, and we’ll walk through these six checks with you. Call (843) 324-5824 or visit advyon.com.

Sources

• City of Columbia: City of Columbia Provides Update on Cybersecurity Incident (Oct. 23, updated Nov. 3, 2026)
• WLTX: City of Columbia confirms ransomware attack (Oct. 23, 2026)
• WIS: Columbia city manager confirms ransomware attack behind service outages (Oct. 23, 2026)
• The State: What city services remain affected by Columbia ransomware attack? (Oct. 28, 2026)
• CISA, FBI, NSA and MS-ISAC: #StopRansomware Guide
• FBI IC3: Business Email Compromise PSA
• SC Critical Infrastructure Cybersecurity (SLED): Report an Incident
• DHS: Fusion Center Locations and Contact Information

Facts current as of Nov. 4, 2026. The host in the video is an AI-generated presenter.