SIOUX FALLS, S.D. (KELO) — This story has been updated with a statement from Sanford’s attorney.


New information on the investigation into South Dakota billionaire Thomas Denny Sanford for the alleged possession and distribution of child pornography is available, with new court documents obtained by KELOLAND News.

The documents in question are an order to seal a search warrant affidavit and the now unsealed affidavit in support of the request for the aforementioned search warrant.

Sanford has not been charged in the investigation, which dates back to 2020 and was sparked by a 2019 tip from the National Center for Missing and Exploited Children to the South Dakota Internet Crimes Against Children Task Force.

The AOL/Oath Inc. user account noted by the tip contained images of child exploitation material and was traced by investigators back to an account used by Sanford and to a phone number for PREMIER bank, which an employee confirmed was used by Sanford, who founded the bank.

Sanford’s legal team, once headed by now South Dakota Attorney General Marty Jackley, had filed documentation in January 2022 they say proves that Sanford’s accounts were hacked.

In 2022, the South Dakota Attorney General’s Office, following the impeachment of then-Attorney General Jason Ravnsborg, issued a statement saying they had found no probable cause for criminal charges in the state in the course of their investigation into Sanford.

In the newly unsealed documents, we learned the investigation into Sanford noted email activity from internet service providers in California, Arizona and South Dakota. It was noted by the investigator that Sanford owns homes in each of these states; in La Jolla, CA, Scottsdale, AZ, and Sioux Falls, S.D.


Within the court documents, at least one of these houses — the one in California — garner additional attention.

It is revealed investigators recovered GPS meta data from the images of child exploitation material. At least one of these was mapped out by the investigator.

This meta data indicates at least one image of child exploitation material was itself taken at the location listed in the GPS data.

Excerpt from affidavit

While the addresses in the affidavit are redacted, KELOLAND News was able to track the address location through the GPS meta data provided and found it pinned to a home in the La Jolla area of California.

By searching the parcel number for the home and cross referencing it with San Diego County property tax records, we were able to find that the property is owned by ES Holdings, LLC.

Screenshot of publicly available property info for San Diego County with the Assessor Parcel Number at the top
San Diego County tax info screenshot

While a search for California entities with the name ES Holdings, LLC turns up varied results, a search of registered entities of that name in South Dakota turns up just one, ES Holdings, LLC, whose principal office is located at 1305 W. 18th St. in Sioux Falls, which is the address for the Sanford Medical Center.

The initial filing for ES Holdings, LLC was made on 11/26/2012, and was filed at the request of Linda R. Ahlers of Sanford Health.

While the presence of a property in California owned by an ES Holdings, LLC and company with the same name formed through Sanford Health in South Dakota may not be enough to tie the two together, one additional detail does.

A San Diego County record of a deed for the property with parcel number 3460900500 — the same house owned by ES Holdings, LLC — which shows the property was sold in December of 2012, roughly a month after ES Holdings, LLC was formed in South Dakota.

The buyer is listed as ES Holdings, LLC. The seller is T. Denny Sanford.

San Diego County deed record

In an emailed statement following publication, Sanford’s legal counsel, Stacey Hegge, reached out with the following statement.

On May 25th, as Mr. Sanford’s counsel, we were made aware that there were more documents related to the closed investigationOn May 25 and May 26, 2023, the Minnehaha County Clerk of Courts then released these additional documents concerning the investigation that was closed over a year ago.  These documents and the documents the Clerk released last month concern the same investigation that the South Dakota Attorney General’s Office terminated when it determined there was no prosecutable offense. While these documents contain the same preliminary allegations that initiated the investigation and acknowledge the hacking and spoofing of the email addresses involved, the documents also show the thorough and extensive investigation the South Dakota Attorney General’s Office undertook prior to finding no offense. 

Stacey Hegge, Gunderson, Palmer, Nelson & Ashmore, LLP

A lawsuit filed by the Argus Leader and ProPublica sought the unsealing of search warrants in the case, a request that was granted by South Dakota courts, with the caveat that the files would remain sealed until the investigation had concluded.

Look for updates on what is found in the newly released documents in this story.