Pennington County, SD Closes Offices After Cybersecurity Incident

Pennington County, based in Rapid City, South Dakota, is responding to a cybersecurity incident that has affected parts of its network. County officials said the closures will let staff assess the situation and safely restore affected systems. As of Sunday afternoon, a county spokesperson said officials were still working to determine the full scope of the incident, and the investigation remains active.

Because the probe is ongoing, officials said they have limited verified information available and expect to issue their public update by 11 a.m. Monday.

Notably, the incident falls within an active election period : the Pennington County Auditor's Office will remain open Monday from 7 a.m. to 4 p.m. for in-person absentee ballot voting ahead of the July 28 run-off election.

Essential public safety functions continue uninterrupted, reports say , including:

The Treasurer's Office will not process in-person transactions, but vehicle registration remains available online at my605drive.sd.gov or via self-service kiosks. Residents relying on county services Monday should expect delays for non-critical, in-person transactions and should check official county channels before visiting closed offices.

The county is working with the South Dakota National Guard Cyber Incident Response Team, the South Dakota Fusion Center, and the Cybersecurity and Infrastructure Security Agency (CISA).

Several U.S. municipalities announced cyber incidents or were listed on threat actor leak sites this year. Last week, INC Ransom added the City of Acworth and the City of Oak Park to its dark web data leak site.

A Foster City ransomware attack disrupted non-emergency operations, Cocoa City issued an emergency declaration related to INC Ransom, and a New Britain City Hall network disruption took systems offline.