RAPID CITY, S.D. – The City of Rapid City experienced a cyber incident involving one of its seven lift stations, which are used as part of the city’s wastewater system.

Jim Gilbert, City of Rapid City Information Technology Department Director, said the city was informed by an individual in the water department of suspicious activity in a circuit – a networked system connected to the internet – that runs the mechanisms in a lift station.

After investigating, Gilbert said it was classified as a denial-of-service attack, focused on an industrial system and was not an attempt to gain access to computer systems.

“We were then able to come to the conclusion that our measures that we had in place were adequate at that time to ensure the safety of the water and we took additional measures as was pointed out by our partners,” Gilbert said.

At no time was the city’s water or wastewater infrastructure systems placed in jeopardy and city officials assure Rapid City residents the city’s water supply remains safe and protected. 

Jeremy Casteel, Water Reclamation Superintendent, said the incident targeted a lift station in the wastewater system, not the drinking water distribution system.

A lift station is a low point in the city where wastewater is collected and is then pumped out to the wastewater plant.  

“The purpose of their attacks is just to get in and try to disrupt the system in any way they can find,” Public Works Director Mike Theis said. “That’s what they were after – trying to disrupt the system to impact services.”

The incident was unrelated to the cyber-attack on Pennington County systems earlier this month.

It’s very unlikely that Rapid City was specifically targeted, rather a wide net was cast to cause disruption.

“These types of attacks are done by computers so the idea that it was targeted at Rapid City is probably not accurate,” Gilbert said. “They just cast a really wide net because it doesn’t cost them anything to send out. …They probably literally attacked hundreds of thousands if not millions of devices.”

The City of Rapid City is currently working with the Cybersecurity and Infrastructure Security Agency (CISA) and other appropriate federal partners.

“I would just say this incident was a good example of the vigilance of our IT department as well as our employees on what they’re trained for on a regular basis and the diligence that our IT takes on security measures to make sure our systems are protected,” Theis said.

Specific details of ongoing cybersecurity or infrastructure security investigations are not available while the investigation is ongoing.