Summerville ransomware disrupts access to incident reports

Ransomware disrupted Summerville’s administrative systems and left police and fire incident reports unavailable to the public in July 2024, while emergency response continued. The town later warned of potential data exposure; Embargo’s claimed theft and the exact restoration date remain unverified.

Incident start: ? Earliest known or assessed start of malicious activity or incident activity. Jul 22, 2024

First public signal: ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. Jul 26, 2024

First public cyber evidence: ? Earliest credible public information connecting the incident or disruption to malicious cyber activity. Jul 26, 2024

Official cyber disclosure: ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. Jul 26, 2024

Last impact seen: ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing. Jul 29, 2024

Primary victim organization

Dorchester County, South Carolina

Summerville, South Carolina

Local / municipal / county government administration

Critical infrastructure sector

Government Services and Facilities

DysruptionHub coverage

Town of Summerville Faces Ransomware Attack

Ransomware Malware that encrypts systems or data, typically accompanied by a ransom demand.

Malware that encrypts systems or data, typically accompanied by a ransom demand.

Data extortion Threats to publish or sell stolen data without evidence of encryption.

Threats to publish or sell stolen data without evidence of encryption.

Unauthorized access Unauthorized access to systems, accounts, networks, or data.

Unauthorized access to systems, accounts, networks, or data.

Unauthorized data access An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.

An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.

Data unavailable Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Partial service outage A service, system, platform, or operational capability remained available only in part or with significant limitations.

A service, system, platform, or operational capability remained available only in part or with significant limitations.

Internal systems unavailable Internal business, administrative, operational, or staff-facing systems were unavailable.

Internal business, administrative, operational, or staff-facing systems were unavailable.

Records access disruption Staff, customers, patients, students, residents, or other users could not access records or case information normally.

Staff, customers, patients, students, residents, or other users could not access records or case information normally.

Records processing disruption The organization could not create, update, , file, approve, transmit, or otherwise process records normally.

The organization could not create, update, , file, approve, transmit, or otherwise process records normally.

Government services disrupted Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.

Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.

Manual workaround required Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

Customer or public access restricted Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.

Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.

Data-theft extortion The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.

The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.

Public leak threat The actor explicitly threatened to publish or publicly release victim data or incident details.

The actor explicitly threatened to publish or publicly release victim data or incident details.

Leak-site listing The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Countdown or payment deadline The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.

The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.

Ransomware disrupted administrative systems in Summerville, South Carolina, and left police and fire incident reports unavailable to the public in July 2024. The town confirmed the attack, while police, fire and public works continued responding to calls. The incident is presumed resolved; the reviewed public record does not establish when report access and all affected systems were restored.

Administrative disruption and response

In its July 29 update , the town said both police and fire departments could not provide incident reports to the public. Emergency and nonemergency routes remained available. Our contemporary coverage also described police using handwritten reports.

The town’s spokesperson told Live 5 News that police administrative systems were down Thursday morning, July 25, and attack activity reached wider town systems Friday before containment. The town’s July 26 announcement said municipal departments remained operational and continued responding to calls. That assurance response services did not mean every administrative function was available.

Conflicting dates and changing data findings

A later official security notice identified Monday, July 22, as the attack date. The difference between that date and the contemporary account of Thursday’s administrative outage remains unexplained. July 22 is retained as the town’s explicitly stated attack date, with July 25 describing the reported onset of visible administrative problems.

The town initially said it had no evidence of compromised data. Its July 29 update subsequently described unauthorized access that likely involved sensitive data. On Aug. 28, it warned of possible exposure involving driver’s license or state identification numbers, dates of birth, addresses and some incident and criminal history reports. The same notice said officials had no indication that specific personal data had been exported, used or made public. The findings establish a potential exposure, without independently verifying the amount allegedly stolen.

Cybernews reported that Embargo listed the police department, alleged taking 1.71 terabytes and displayed a July 30 deadline. It reported no supporting data samples. A matching listing is also present in the native ransomware-claim record. The listing supports attribution of the claim to Embargo; it does not independently establish that the group conducted the attack or stole the claimed volume.

The town said attackers were expelled and worked with state and federal investigators. No reviewed source established a complete restoration date, ransom amount or payment outcome. July 29 is the latest supported observation of continuing operational disruption. The later breach notice does not extend that operational period, and the exact end date remains unknown.

Embargo alleged taking 1.71 terabytes from the Summerville Police Department. Cybernews observed the listing and a July 30 countdown, without data samples. The town confirmed ransomware and possible exposure, but did not independently verify the claimed volume or actor responsibility.

Locations Summerville, South Carolina Dorchester County, South Carolina Organization type Local / municipal / county government administration Critical infrastructure Government Services and Facilities

Summerville, South Carolina

Dorchester County, South Carolina

Local / municipal / county government administration

Critical infrastructure

Government Services and Facilities

Dorchester County, South Carolina Dorchester County contains the affected municipal organization’s headquarters at 200 South Main Street. This is a qualified physical anchor for the municipal ransomware incident, not an assertion that Dorchester County government was attacked or that impacts covered the whole county. Source

Dorchester County, South Carolina

Dorchester County contains the affected municipal organization’s headquarters at 200 South Main Street. This is a qualified physical anchor for the municipal ransomware incident, not an assertion that Dorchester County government was attacked or that impacts covered the whole county.

Summerville, South Carolina The affected government’s service remit is the incorporated Town of Summerville. Its police/fire incident-report service was unavailable to the public on July 29. This qualifies the municipal service area without asserting all services stopped or every record was exposed. Summerville contains the town’s administrative offices at 200 South Main Street. The town confirmed ransomware affecting administrative systems and restricting police/fire incident-report access. Preserve this physical organizational anchor; the evidence does not identify every affected premise. Source

Summerville, South Carolina

The affected government’s service remit is the incorporated Town of Summerville. Its police/fire incident-report service was unavailable to the public on July 29. This qualifies the municipal service area without asserting all services stopped or every record was exposed.

Summerville contains the town’s administrative offices at 200 South Main Street. The town confirmed ransomware affecting administrative systems and restricting police/fire incident-report access. Preserve this physical organizational anchor; the evidence does not identify every affected premise.

The intake article describes ransomware affecting town administration, handwritten police reports and Embargo’s allegation.

Type: Official Statement

Platform: Social Platform

The town confirmed ransomware, containment and continued police, fire and public works response.

The spokesperson described police administrative systems down Thursday morning and attack activity in wider town systems Friday before containment.

Type: Operational Update

The town said police and fire incident reports were unavailable to the public and unauthorized access likely involved sensitive data.

Type: Official Statement

The town dated the ransomware attack July 22 and warned of possible exposure of identifiers and police reports, while saying it had no indication specific personal data was exported, used or made public.

Type: Threat Actor Source

Native claim lookup returned one Embargo listing naming summervillepolice.com and alleging 1.71 terabytes.

Cybernews observed an Embargo listing alleging 1.71 terabytes and a July 30 deadline; it reported no data samples or confirmation from the town.

See something that needs correction?

Signed-in members can report an error, update, or missing source.

Sign in or create a free DysruptionHub account to report an error, update, or correction.