City of Columbia Confirms Ransomware Attack on Municipal Systems

What happened

On 25 October 2026 the City of Columbia disclosed a ransomware intrusion that encrypted files on its public‑works ticketing system, finance invoicing platform, and other municipal servers. Forensic analysis traced initial access to a compromised Remote Desktop Protocol (RDP) account lacking multi‑factor authentication. The attackers moved laterally across the Windows domain, deploying a ransomware payload identified by its unique hash, and demanded cryptocurrency payment. The city engaged the South Carolina State Law Enforcement Division (SLED) for investigation and began a security audit. Critical public services remain offline while data restoration from offline backups is in progress. No confirmed exfiltration of resident or employee personal data has been reported, though the ransom note referenced “sensitive municipal records.”

Why it matters for trust and compliance

• Ransomware tests recovery before anything else. Check that backups are isolated and that restores have actually been rehearsed.

Who is affected

Recommended actions

1. Enforce multi‑factor authentication on all remote‑access accounts, especially RDP.
2. Implement network segmentation and zero‑trust controls to limit lateral movement.
3. Ensure backups are immutable/air‑gapped and conduct regular restoration drills.