Spartanburg County network outage disrupted services

Analyst assessment

Spartanburg County isolated portions of its computer environment after detecting activity that warranted further review around June 10, 2026. DysruptionHub’s published report documented a multi-day network and internet outage while the South Carolina Law Enforcement Division’s critical-infrastructure cybersecurity unit assisted.

DysruptionHub assesses with medium confidence that the event involved malicious or unauthorized cyber activity. The county’s isolation and security-review response, together with the state cybersecurity investigation, support a suspected cyber incident, but officials have not confirmed an intrusion, malware, ransomware or another attack mechanism.

Operational significance

The outage materially affected county government for nearly three weeks. WYFF reported disruption to phones, computers, court functions and records access. Some offices could not process card payments or provide licensing and deed documents, sheriff’s personnel used handwritten reports, and staff relied on personal or alternative resources to answer requests.

Core network availability returned, but restoration was not an unqualified all-clear. The county said employee connectivity had resumed while some services could still experience isolated delays as devices and applications were validated and brought fully back into normal operation.

Disclosure posture

The county consistently described questionable activity, precautionary isolation and a security review rather than a confirmed cyberattack. That caution is analytically material: the public record establishes a cyber-response context and substantial disruption, but it does not establish malicious access, a specific technique or responsibility for the event.

Current status

The county’s June 29 statement, independently reported by FOX Carolina, said core services were restored but isolated delays could continue while systems returned fully to normal. No later full-restoration notice was found by July 26. The incident is therefore presumed active under the operational-impact lifecycle, reflecting the age of the last documented residual impact rather than evidence of a renewed outage.

Confidence and uncertainty

Confidence is high that the event caused material operational disruption, but medium that malicious cyber activity caused it because no confirmed intrusion or attack type has been disclosed. The county said it had not identified evidence that data was accessed, exfiltrated or compromised, although its security review remained ongoing. Ransomware and threat-actor attribution remain unresolved; no encryption, demand, leak-site claim, payment or responsible actor has been identified.

Analytic gaps

The reviewed sources do not establish the triggering activity, initial access vector, affected hosts, vulnerability, compromised account, malware, persistence or whether attacker activity versus defensive isolation caused each service effect. They also do not provide a final security-review conclusion, a system-by-system all-clear or a date when the last isolated service delay ended.