Ransomware disrupted Summerville’s administrative systems and left police and fire incident reports unavailable to the public in July 2024, while emergency response continued. The town later warned of potential data exposure; Embargo’s claimed theft and the exact restoration date remain unverified.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Threats to publish or sell stolen data without evidence of encryption.
Unauthorized access to systems, accounts, networks, or data.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.
The actor explicitly threatened to publish or publicly release victim data or incident details.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.
Ransomware disrupted administrative systems in Summerville, South Carolina, and left police and fire incident reports unavailable to the public in July 2024. The town confirmed the attack, while police, fire and public works continued responding to calls. The incident is presumed resolved; the reviewed public record does not establish when report access and all affected systems were restored.
In its July 29 update, the town said both police and fire departments could not provide incident reports to the public. Emergency and nonemergency contact routes remained available. Our contemporary coverage also described police using handwritten reports.
The town’s spokesperson told Live 5 News that police administrative systems were down Thursday morning, July 25, and attack activity reached wider town systems Friday before containment. The town’s July 26 announcement said municipal departments remained operational and continued responding to calls. That assurance about response services did not mean every administrative function was available.
A later official security notice identified Monday, July 22, as the attack date. The difference between that date and the contemporary account of Thursday’s administrative outage remains unexplained. July 22 is retained as the town’s explicitly stated attack date, with July 25 describing the reported onset of visible administrative problems.
The town initially said it had no evidence of compromised data. Its July 29 update subsequently described unauthorized access that likely involved sensitive data. On Aug. 28, it warned of possible exposure involving driver’s license or state identification numbers, dates of birth, addresses and some incident and criminal history reports. The same notice said officials had no indication that specific personal data had been exported, used or made public. The findings establish a potential exposure, without independently verifying the amount allegedly stolen.
Cybernews reported that Embargo listed the police department, alleged taking 1.71 terabytes and displayed a July 30 deadline. It reported no supporting data samples. A matching listing is also present in the native ransomware-claim record. The listing supports attribution of the claim to Embargo; it does not independently establish that the group conducted the attack or stole the claimed volume.
The town said attackers were expelled and worked with state and federal investigators. No reviewed source established a complete restoration date, ransom amount or payment outcome. July 29 is the latest supported observation of continuing operational disruption. The later breach notice does not extend that operational period, and the exact end date remains unknown.
Embargo alleged taking 1.71 terabytes from the Summerville Police Department. Cybernews observed the listing and a July 30 countdown, without data samples. The town confirmed ransomware and possible exposure, but did not independently verify the claimed volume or actor responsibility.
Dorchester County contains the affected municipal organization’s headquarters at 200 South Main Street. This is a qualified physical anchor for the municipal ransomware incident, not an assertion that Dorchester County government was attacked or that impacts covered the whole county.
The affected government’s service remit is the incorporated Town of Summerville. Its police/fire incident-report service was unavailable to the public on July 29. This qualifies the municipal service area without asserting all services stopped or every record was exposed.
Summerville contains the town’s administrative offices at 200 South Main Street. The town confirmed ransomware affecting administrative systems and restricting police/fire incident-report access. Preserve this physical organizational anchor; the evidence does not identify every affected premise.
The intake article describes ransomware affecting town administration, handwritten police reports and Embargo’s allegation.
The town confirmed ransomware, containment and continued police, fire and public works response.
The spokesperson described police administrative systems down Thursday morning and attack activity in wider town systems Friday before containment.
The town said police and fire incident reports were unavailable to the public and unauthorized access likely involved sensitive data.
The town dated the ransomware attack July 22 and warned of possible exposure of identifiers and police reports, while saying it had no indication specific personal data was exported, used or made public.
Native claim lookup returned one Embargo listing naming summervillepolice.com and alleging 1.71 terabytes.
Cybernews observed an Embargo listing alleging 1.71 terabytes and a July 30 deadline; it reported no data samples or confirmation from the town.
Signed-in members can report an error, update, or missing source.
