RAPID CITY, S.D – Michael Iversen has spent the past three months doing anything and everything he can to prevent another workplace nightmare like the one inflicted upon him and his staff on July 4.
On that day, unknown hackers broke into and disrupted major elements of the government computer system in Pennington County, where Iversen serves as information technology director.
The ransomware attack forced the county to shut down many systems, including communications and several public-facing services, though law enforcement, emergency operations and jail facilities remained largely operational.
Nearly all services are back online, but the attack thrust Iversen into a posture of crisis management that he remains immersed in to this day.
“You see something like this come in, and your brain is going a million miles an hour,” Iversen told News Watch in an interview. “It’s one of the worst things I’ve ever dealt with, and I wouldn’t wish this on my worst enemy.”
In the roughly 90 days since, Iversen has had two major goals — to bring county systems back online and to prevent or prepare for another attack – and he hopes other local governments can learn from Pennington County’s experience.
While security protocols prevent him from being too specific, Iversen said he and other county officials have already implemented many new or improved measures to combat another attack. Among them:
- Rebuilding the entire county IT system with enhanced security at the forefront
- Increasing the depth and frequency of employee training, including requiring all county employees to change every password they were using prior to the attack
- Making preparations to hire a new full-time IT employee specifically assigned to strengthen security and monitor possible intrusions
- Implementing a SIEM, or Security Information and Event Management system, that centralizes all IT data and makes it easier to both analyze and protect
- Working with state cyberattack prevention officials at Secure SD to move to a government cloud storage system that is more safe and secure
- Switching the county operating systems to a .gov suffix, which stiffens security due to federal requirements to use the government domain system
Iversen said he has received strong support for the changes from employees and the Pennington County Commission but still doesn’t know if or how much more funding might be required to stiffen cyber defenses.
“We’ve basically rebuilt our network from the ground up and redone all our security policies,” said Iversen, whose department has a staff of 13 and an annual budget of about $1.5 million. “The public probably won’t notice and the functionality will be there, but the county will not be the same as it was before.”
The cyberattack on Pennington County was one of several that took place in a period of about a month this summer.
Rapid City fought off a brief attack on its wastewater systems, and the city of Mitchell dealt with a hack of some of its municipal computer systems. Around that same time, a major cybersecurity attack that sought to disrupt water systems in more than 30 communities across Minnesota.
South Dakota has been battling cyberattacks for years. Officials in Aberdeen found destructive malware installed on city systems in 2021. And last year, an employee in Tripp County was fooled by a hacker into sending more than $800,000 in municipal funds to a fake account.
Gov. Larry Rhoden on Sept. 30 declared October as Cybersecurity Awareness month in South Dakota with a theme of “Don’t make it easy for them.”
The state Attorney General’s Office told News Watch in August that over the past five years, the agency has had 1,062 online security breaches reported to its Consumer Affairs Division, including more than 125 so far in 2026.
Mitchell Mayor Jordan Hanson told News Watch that even though the city was well-positioned to prevent a cyberattack, their systems were hacked nevertheless.
“It’s very common across the United States, and my speculation is that there’s people out there trying this constantly and it just takes the tiniest little opening for them to get in,” Hanson said. “Hopefully, like us, other cities have an experienced staff that is prepared to handle things.”
Hanson said the city has since taken several steps to bolster cybersecurity, but he declined to release specifics.
“There’s always room for improvement,” he said.
South Dakota News Watch is an independent nonprofit. Read, subscribe for free and donate at sdnewswatch.org. Contact content director Bart Pfankuch: 605-937-9398/ bart.pfankuch@sdnewswatch.org.