Spartanburg County network outage disrupted services

Analyst assessment

Spartanburg County isolated portions of its computer environment after detecting questionable activity on June 10, 2026. Our June 15 report documented the multi-day network and internet outage while the South Carolina Law Enforcement Division’s critical-infrastructure cybersecurity unit assisted.

The county never publicly labeled the event a cybersecurity incident or cyberattack. It also did not confirm malicious or unauthorized access. However, its acknowledgement of questionable activity on county computer infrastructure, precautionary network isolation, additional security checks and a SLED cybersecurity investigation is concrete cyber-specific evidence under registry policy. The registry therefore retains confirmed cyber involvement, a narrower finding than confirmation that an attacker caused the incident.

Operational significance

The outage materially affected county government for nearly three weeks. WYFF reported disruption to phones, computers, court functions and records access. Some offices could not process card payments or provide licensing and deed documents, sheriff’s personnel used handwritten reports, and staff relied on personal or alternative resources to answer requests.

The county said core network services and employee connectivity were restored June 29. That update was not an unqualified all-clear: officials said some services could continue to experience isolated delays while devices and applications reconnected and systems were validated and returned fully to normal operation.

Current status

Operations are presumed resolved. By Aug. 3, the county’s former outage alert returned a 404 page, the regular county website displayed routine government information and its Citizen Self Service link was available. A Sept. 3 review found no later county notice or credible report documenting continuing delays, unavailable systems, manual workarounds or restoration activity.

June 29 remains the latest confirmed date of operational impact because the county said residual delays could continue on that date. The absence of newer impact evidence and the county’s normal public-web posture support presumed resolution. The status is not resolved because no retrospective all-clear identified when the last isolated issue or validation work ended.

Disclosure posture

On June 12, FITSNews reported that SLED’s South Carolina Critical Infrastructure Cybersecurity unit was assisting and its investigation was active. That established a cyber-response context, but the reported facts still described an unexplained outage and did not assert that malicious cyber activity had occurred. The county’s own June 12 notice also contained only outage language. Neither constitutes XC.

The first qualifying concrete cyber evidence came from the county June 22. It told WYFF that it had detected questionable activity on its computer infrastructure and isolated its networks to protect them while security work proceeded. Because the first qualifying cyber-specific disclosure came from the affected organization, the cyber-transparency classification is OC.

The county’s June 29 statement, reproduced by FOX Carolina, said it had not identified evidence that data was accessed, exfiltrated or compromised. The security review was still ongoing. No final review, later breach notice, regulator filing, affected-data category or affected-person count has been published for this event.

Confidence and uncertainty

Confidence is high that the event caused material operational disruption. Overall incident confidence remains medium because the county documented suspicious system activity and a cybersecurity response but did not disclose a final cause or confirm a malicious intrusion. The county’s security-response wording supports confirmed cyber involvement under the registry definition; the earlier presence of SLED’s cyber unit does not independently prove cyber activity, and neither establishes a completed attack.

Confidentiality and integrity impacts remain unresolved. The county’s no-data-compromise statement is an important interim finding, but no completed security-review conclusion has been published. Ransomware and threat-actor attribution also remain unresolved; no encryption, demand, leak-site claim, payment or responsible actor has been identified.

Analytic gaps

The public record does not establish the triggering activity, whether it was malicious, the initial access vector, affected hosts, vulnerability, compromised account, malware, persistence or whether attacker activity rather than defensive isolation caused each service effect. It also does not provide a final security-review conclusion, a system-by-system all-clear or the date when the last isolated service delay ended.