Three true stories. Three convincing tricks. And three cybersecurity lessons worth remembering.
It’s almost Halloween. The pumpkins are glowing, the nights are getting longer, and there’s nothing quite like a scary story around the campfire.
So pull up a chair. Get comfortable. And keep an eye on the shadows.
Tonight, we’re sharing three cybersecurity horror stories that happened much closer to home than you might expect: a fraudulent payment in a South Carolina beach town, a terrifying call to North Carolina parents, and a hospital cyberattack in the Lowcountry.
No ghosts. No monsters. Just familiar technology, convincing tricks, and real people caught in situations they never expected. These incidents were real. Ready? Let’s begin.
Story 1: The Email That Cost a South Carolina Town More Than Half a Million Dollars
Our first story begins in Surfside Beach, South Carolina, with a construction project, an ordinary payment, and an email that looked like the real thing.
Imagine working in a town office where a contractor has recently completed work. The invoice arrives, the payment needs to be processed, and everything seems routine. But the email with the payment instructions isn’t really from the contractor.
In March 2026, the Town of Surfside Beach was targeted by a payment diversion scheme involving a contractor on an Ocean Boulevard utility project. Fraudsters used lookalike email domains and convincing communications to redirect a payment.
The town sent $545,598.30 to an account controlled by criminals instead of the intended contractor. An independent investigation reported no evidence that the town’s Microsoft 365 accounts had been compromised. Instead, the attackers had relied on an impersonation technique rather than a confirmed takeover of those accounts.
The frightening part? A small difference in an email address helped turn an ordinary transaction into a major financial loss.
The Trick: One Small Change, One Very Expensive Mistake
Criminals can register lookalike email domains or impersonate trusted vendors. A missing letter or subtle spelling change can be easy to miss. Schools, nonprofits, municipalities, construction firms, and businesses all handle payments that could be targeted this way.
The Treat: Verify Before You Pay
- Call vendors using a trusted phone number already on file before changing payment instructions.
- Require a second person to approve changes to banking details.
- Examine sender addresses carefully, particularly when payment instructions change.
- Never use an email alone as proof of where money should go.
Remember: One small change in an email address can lead to one very expensive mistake.
Source: Town of Surfside Beach — Independent Investigation Findings
Story 2: The Voice on the Phone That Wasn’t Their Son
Our second story takes us to North Carolina, where a phone call brought a family face to face with a parent’s worst fear.
Imagine answering your phone and hearing someone who sounds like your child. He says he’s been in a car accident and ended up in a jail cell. He’s frightened and he needs help. There is another person there claiming to be an attorney who says money must be sent quickly to avoid a night in detention.
A published case account describes a 2024 call to the family of a UNC Asheville student, a student at the University of North Carolina Asheville. Someone sounding like the student claimed he had been in an accident that got him arrested. A purported attorney was also on the phone, demanding $17,400 for a bond payment.
The family checked the story rather than sending money. They found no matching jail booking and reached the student directly to discover he was safe in his dorm room. The emergency had been invented.
The Trick: A Familiar Voice and an Urgent Demand
Scammers use fear, urgency, and details that sound credible to push families into acting without checking. Modern voice-cloning tools can increase the risk, but a familiar-sounding voice alone does not establish who is calling.
The Treat: Have a Family Verification Plan
- Agree on a private family code word for unexpected emergencies.
- Call your loved one using a number you already know, or contact someone who is with them.
- Be wary of secrecy, pressure, and demands for immediate payment.
- Contact law enforcement to check claims of an arrest or kidnapping.
Remember: Just because a voice sounds familiar does not mean the caller is who they claim to be.
Story 3: The Day a South Carolina Hospital Went Dark
Our final story takes us to Varnville, South Carolina, where a cyberattack disrupted a community hospital and affected the people who depended on it.
It’s July 2025. At Hampton Regional Medical Center, important computer systems aren’t working as they should. Local reporting described canceled appointments, problems obtaining medications and accessing records, and some patients being transferred to other facilities when services were unavailable.
The hospital subsequently disclosed unauthorized access to certain systems between June 18 and July 16, 2025, and warned that personal information might have been accessed or taken.
The most frightening part was not simply that computers were affected. It was that the disruption reached patients and families who depended on the hospital for care.
The Trick: When Essential Technology Becomes Unavailable
A cyber incident can interrupt services well beyond the IT department. Hospitals, schools, local governments, and businesses all rely on systems and records to serve people every day.
The Treat: Prepare Before Something Goes Wrong
- Require multifactor authentication for important accounts and remote access.
- Maintain protected backups and test recovery regularly.
- Identify the services and systems most critical to daily operations.
- Plan practical workarounds for outages and rehearse who does what.
Remember: Cybersecurity isn’t just about protecting computers. It’s about protecting the people and services that depend on them.
The Fire Is Getting Low. What’s the Lesson?
Three stories. Two states. Three very different consequences. A South Carolina town lost more than half a million dollars to fraudulent payment instructions. North Carolina parents received a frightening call from someone pretending to be their son. A South Carolina hospital experienced a cyber incident that disrupted care.
What connects these stories? Trust. Trust in a familiar email. Trust in a familiar voice. Trust in the technology we depend on every day.
The good news is that small, practical habits can make these tricks harder to pull off: Stop. Question. Verify.
Stop before responding to an unexpected request. Question anything unusual. Verify through a trusted method before sharing information, sending money, or taking action.
This Halloween, Don’t Let a Cyber Trick Become Your Next Horror Story
Halloween is supposed to be about harmless scares, costumes, and a little fun. A real cybersecurity incident is another story. Whether you are protecting a business, nonprofit, school, municipality, or your own family, understanding the risks is the first step toward protecting what matters.
SpartanTec helps organizations throughout North and South Carolina identify technology and cybersecurity risks before they become bigger problems. Our safety and risk assessment helps identify vulnerabilities and prioritize practical improvements.
SpartanTec
We Guard Your Assets.
Frequently Asked Questions
Can small organizations in the Carolinas be targeted?
Yes. Schools, local governments, nonprofits, and businesses can all face impersonation scams, payment fraud, and cyber incidents.
What is business email compromise?
A scam in which criminals impersonate trusted contacts or misuse email accounts to persuade people to send money or sensitive information.
Can scammers imitate a family member’s voice?
Yes. Scammers may use acting, recordings, or voice-generation technology. Always independently verify urgent requests.
What can organizations do to reduce cyber risk?
Use multifactor authentication, payment verification, security updates, tested backups, staff awareness, and a review of critical technology dependencies.
