Spartanburg County network outage disrupted services

Analyst assessment

Spartanburg County isolated portions of its computer environment after detecting questionable activity around June 10, 2026. Our June 15 report documented a multi-day network and internet outage while the South Carolina Law Enforcement Division’s critical-infrastructure cybersecurity unit assisted.

The county’s description of questionable activity inside its systems is concrete cyber-specific evidence, so the registry classifies cyber involvement as confirmed. That classification does not mean officials confirmed a malicious intrusion or cyberattack. The public record does not establish unauthorized access, malware, ransomware, another attack mechanism or whether deliberate attacker activity caused the disruption.

Operational significance

The outage materially affected county government for nearly three weeks. WYFF reported disruption to phones, computers, court functions and records access. Some offices could not process card payments or provide licensing and deed documents, sheriff’s personnel used handwritten reports, and staff relied on personal or alternative resources to answer requests.

The county said core network services and employee connectivity were restored June 29. That update was not an unqualified all-clear: officials said some services could continue to experience isolated delays while devices and applications reconnected and systems were validated and brought fully back into normal operation.

Current status

Operations are presumed resolved. By Aug. 3, the county’s former outage alert returned a 404 page, the regular county website displayed routine government information and its Citizen Self Service link was available. No later county notice or credible report documented continuing delays, unavailable systems, manual workarounds or restoration activity.

June 29 remains the latest confirmed date of operational impact because the county said residual delays could continue on that date. More than 30 days later, the absence of newer impact evidence and the county’s normal public-web posture support presumed resolution. The status is not resolved because no retrospective all-clear identified when the last isolated issue or validation work ended.

Disclosure posture

The county consistently described questionable activity, precautionary isolation and a security review rather than a confirmed cyberattack. That distinction is analytically material: the public record establishes a cyber-response context and substantial disruption, but it does not establish malicious access, a specific technique or responsibility for the event.

The county’s June 29 statement, reproduced by FOX Carolina, said officials had not identified evidence that data was accessed, exfiltrated or compromised. The security review was still ongoing in that update. No final review, later breach notice, regulator filing, affected-data category or affected-person count has been published for this event.

Confidence and uncertainty

Confidence is high that the event caused material operational disruption. Overall incident confidence is medium because the county documented questionable activity and a cybersecurity response but did not disclose a final cause or confirm a malicious intrusion. SLED cybersecurity involvement and the county’s response support confirmed cyber involvement under the registry definition; they are not proof of a completed attack.

Confidentiality and integrity impacts remain unresolved. The county’s no-data-compromise statement is an important interim finding, but no completed security-review conclusion has been published. Ransomware and threat-actor attribution also remain unresolved; no encryption, demand, leak-site claim, payment or responsible actor has been identified.

Analytic gaps

The public record does not establish the triggering activity, whether it was malicious, the initial access vector, affected hosts, vulnerability, compromised account, malware, persistence or whether attacker activity rather than defensive isolation caused each service effect. It also does not provide a final security-review conclusion, a system-by-system all-clear or the date when the last isolated service delay ended.