City of Columbia Investigates Ransomware Attack With SLED

Key Takeaways

• City officials are working with SLED and cybersecurity specialists to assess the ransomware attack.
• The affected systems, potential data exposure, ransom demands, and restoration timeline remain unconfirmed.
• Rising public-sector attack volumes are putting greater pressure on municipal recovery and communication plans.

City of Columbia officials are investigating a ransomware attack that disrupted public-facing municipal services, bringing in SLED and cybersecurity specialists to determine its scope. Officials have not disclosed which systems were compromised, how attackers obtained access, or whether sensitive information was removed from the city's environment.

Those unanswered questions matter. During the opening stages of a ransomware response, investigators commonly need to preserve evidence, isolate affected infrastructure, identify compromised accounts, and distinguish encrypted systems from services taken offline as a precaution. Public disclosure can lag behind technical work, particularly when announcing details could interfere with containment or law enforcement activity.

For residents and businesses, the immediate issue is service availability. Municipal technology environments can support billing, permitting, licensing, communications, records management, and other everyday functions. Even when core public-safety operations remain available, interruptions to administrative systems can create backlogs that persist after individual applications return. The available information does not identify which City of Columbia services were affected.

The broader threat picture offers some context. Government ransomware incidents increased from 95 between April 2023 and April 2024 to 322 between April 2024 and April 2025, a 235.4% rise, according to Zscaler ThreatLabz data included in current public-sector threat research. Ransomware also appeared in 30% of the public-sector breaches covered by Verizon's 2025 dataset.

Municipal agencies often operate a mixed estate of legacy applications, cloud services, employee endpoints, contractor access, and specialized departmental systems. That variety can make containment and restoration slower. It also raises a practical question: which services should return first when multiple departments depend on the same identity, network, or database infrastructure?

Recent reporting from Springbrook counted 276 ransomware attacks against U.S. government entities during the first three quarters of 2025, involving more than 443,000 confirmed breached records. Separately, according to Sophos data, state and local governments reported average recovery costs of $1.53 million in 2025, excluding ransom payments. The financial effect can extend beyond forensic services to overtime, replacement equipment, legal review, resident notification, and delayed municipal work.

Attackers have kept public agencies in view. An October 2026 CISA advisory on SafePay specifically identifies state, local, tribal, and territorial governments among affected sectors and directs victims to the agency's ransomware response checklist. CISA has also issued recent guidance involving Gunra, while LockBit has appeared in public-sector threat assessments. None of those groups has been publicly connected to the City of Columbia incident.

That distinction is important. There is no verified information identifying the attacker, describing a ransom demand, confirming data exfiltration, or establishing whether encryption reached production systems. There is also no announced restoration timetable. In the absence of those findings, assigning a ransomware family or speculating about particular technology suppliers would get ahead of the evidence.

Recovery planning tends to be where preparation becomes visible. World Wide Technology has highlighted ransomware's operational impact across the public sector, where prolonged outages can affect both agency employees and the communities they serve. Guidance such as the NIST Cybersecurity Framework 2.0 and CISA's StopRansomware Guide emphasizes asset inventories, tested incident-response procedures, resilient backups, recovery exercises, and coordinated communications.

Still, backups alone do not settle the issue. Agencies need confidence that restored systems are clean, identities have been secured, and dependencies are brought back in a controlled order. Otherwise, a fast restart can reintroduce the original foothold. For the City of Columbia, the next meaningful updates will likely concern affected services, evidence of data access, recovery progress, and any steps residents or municipal partners should take. Until then, the investigation with SLED and cybersecurity specialists remains the central source of verified information.