Skip to content
DysruptionHub
Sign in Subscribe

Spartanburg County cyberattack caused data and recovery losses

Summary

Spartanburg County, South Carolina logo

Spartanburg County detected unauthorized network access in August 2025 and later confirmed files were copied without permission. A subsequent county record described database loss and an ERP restoration failure in December, while Qilin’s attribution claim remains unverified.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Medium
Attribution:
Low

Attack mechanisms

Data impacts

  • Data theft or exfiltration

    Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Online portal unavailable

    A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Application unavailable

    A specific application or software platform became unavailable or unusable.

  • Database unavailable

    A database or data-management system became unavailable or inaccessible.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Records processing disruption

    The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.

  • Government services disrupted

    Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

Analyst assessment

Spartanburg County, South Carolina, detected unauthorized access to part of its network on Aug. 6, 2025. The county’s later notification letter confirms that files were copied without permission. The detection date is the earliest supported incident activity, rather than a verified first day of intrusion.

We reported Aug. 8 that the county had contained a cyber incident and disabled connections and electronic services while restoring systems. Contemporaneous reporting said offices remained open and 911 and emergency communications operated normally, while some online services were unavailable.

Operational significance

The initial public account described limited service interruption. By Aug. 20, officials acknowledged access to employee on-boarding files containing some personal information and offered monitoring to county employees.

Later internal findings describe more serious recovery failures. A redacted county letter dated June 10, 2026, published with FOX Carolina’s October report, attributes systemwide disruption, loss of the 2025 coroner database and failure to restore an on-premises Tyler ERP system in December 2025 to security and backup shortcomings revealed by the August incident.

These are the county administration’s findings in an employment record, not an independent forensic determination of every technical cause. They nevertheless contradict a reading of the December consumer notice’s statement that services were not materially affected as proof of complete operational recovery. The record does not establish that the affected software vendors themselves were compromised.

Confidence and uncertainty

Confidence is high in unauthorized access, file copying and operational disruption. The South Carolina breach register lists 9,756 affected South Carolina residents and a Dec. 23, 2025 report date. That is a state-resident count, not a verified nationwide total. The county’s letter says file review finished Dec. 8; the specific data elements beyond names are redacted in the public copy.

Comparitech reported that Qilin claimed the attack and asserted it stole 390 GB and published extensive records. The county had not verified Qilin’s claim. Confirmed file copying does not independently establish the claimed volume, publication scope or named actor. Attribution confidence is low and ransomware-related confidence is medium; no reviewed victim statement confirms encryption or a ransom/payment outcome.

Analytic gaps

The intrusion’s precise start, entry route, malware, encryption scope, ransom demand, payment outcome, national affected population and full recovery date remain unestablished. The mechanism behind the reported database loss is also not established. The letter’s separate March 2026 audit-log concern had persisted across several years and is not automatically assigned to this incident.

The April 2023 attack and June 2026 network outage are separate events. Their restoration notices, ransom details and data findings are not imported into the August 2025 record.

Operations are presumed resolved based on elapsed time since the latest documented technical recovery failure in December 2025. The source dates that failure only to December; no exact day or complete-restoration date is established. Publication of the internal letter in October 2026 does not establish a new outage on that publication date.

Threat actor and claim

Qilin

Listed as: spartanburgcountySource: ransomware.liveDiscovered:

Claim details

Qilin listed Spartanburg County using its historical www.spartanburgcounty.org website. The tracker discovered the entry Sept. 17, 2025; the original post time is unverified. Comparitech reports a 390 GB claim and alleged publication, which the county has not verified. The county independently confirms unauthorized copying, without confirming Qilin attribution, encryption or a ransom/payment outcome. The existing claim is repaired without duplication; unrelated 2023 and 2026 events are excluded.

Organizations involved

Impacted locations

  • Spartanburg County, South Carolina

    The county jurisdiction supplies governmental service context for affected online transactions, personnel records and administrative recovery. It does not imply every municipality, resident or emergency-service function was technically affected.

    Source

  • Spartanburg, South Carolina

    Spartanburg is the county government headquarters and administrative site anchor. The county jurisdiction is represented separately; this does not assert city-government compromise or citywide loss of emergency services.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.