Pennington County restores services after ransomware
The South Dakota county says all departments are running again after a July 4 ransomware attack, though some services remain limited.
By Priya Nair · Published · Updated · 4 min read
Pennington County, South Dakota, says all departments are operational again after a ransomware attack discovered over the July 4 holiday, KOTA reports.
What happened
- Suspicious activity was detected on the county's network on July 4.
- Investigators found hackers had deployed ransomware, so IT staff took systems offline to contain it.
- Some systems and public services are still limited, and there is no timeline for full recovery.
The county credited the South Dakota National Guard Cyber Incident Response Team, CISA, the FBI and the state fusion center for help.
Why it matters
Local governments hold sensitive data and run essential services but rarely have large security budgets. Recovery takes months, as this case shows — nearly three months later, services are still not fully restored.
What the county is doing
Officials say they are investing in more security technology, employee training and other measures.
Lessons for small public bodies
- Ask state and federal agencies for help early — CISA offers free services to local governments.
- Keep offline backups and practise restoring key systems.
- Use multi-factor authentication on email and remote access.
