Columbia, South Carolina Confirms Ransomware: A Day-by-Day Timeline of the Outage, and What Stayed Running
South Carolina’s capital city has confirmed that a ransomware attack discovered October 20 took several resident-facing apps offline, while police, fire, 911, water and payments kept running. Here is the timeline so far and the lessons for any organization’s continuity plan.
The City of Columbia, South Carolina’s capital, has confirmed that it was hit by ransomware. Several services residents use every day are offline, but the city says its emergency and utility systems have kept working, a sign that its separation between critical and everyday systems held.
This timeline draws on WIS’ report on the city manager’s confirmation and the City of Columbia’s official update.
Timeline
- Tuesday, October 20: The city’s IT department sees suspicious activity on the network and contacts the South Carolina Law Enforcement Division (SLED), which opens a criminal investigation. Affected applications are taken offline as a precaution.
- Wednesday, October 21: Animal Services temporarily shuts down after disruptions to the city network and its shelter management software, according to WIS.
- Friday, October 23: The city publishes an update confirming a ransomware attack, and City Manager Teresa Wilson repeats the confirmation in a video posted to Facebook. The city says the incident involved sensitive data on its network and that it is still determining what may have been accessed. WIS reports the FBI is aware of the breach but not involved; the city says SLED may work with the FBI and other partners as appropriate.
- As of this weekend: There is no timeline for restoring the affected services. The city says it has brought in outside cybersecurity professionals to advise on its action plan.
What is down, and what is running
Offline: the MyColaSC service request app, Animal Services online services, Parks and Recreation reservations and the city’s Geographic Information Systems. Residents can call (803) 545-3300 for requests usually filed through MyColaSC, such as potholes, fallen trees and broken streetlights.
Operational: the Columbia Police Department, Columbia-Richland Fire Department, 911 communications, Columbia Water systems and the Payment Center, including online payments. Departments affected by the outage have switched to alternative processes.
A city employee who spoke to WIS anonymously described the situation behind the scenes as chaotic, with staff unable to clock in and out. The city has not said which ransomware group is responsible or whether a ransom was demanded.
What this means for your company
Columbia’s situation shows two things worth copying and one worth avoiding. Its most important services kept running, which suggests they were separated from the systems that went down. It also had a phone number ready as a fallback for an app residents rely on. The weak spot was everyday tools like time clocks, which staff only notice when they fail. Write down which systems your business cannot operate without for a day, make sure they are separated from general office systems and backed up offline, and keep paper or phone fallbacks for timekeeping, scheduling and customer requests.
Need help building a ransomware continuity plan that keeps your critical services running during an outage? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
