The Sault Ste. Marie Tribe of Chippewa Indians, Michigan’s largest federally recognized tribe with over 44,000 members, suffered a ransomware attack that forced the complete shutdown of all five Kewadin Casino locations and disrupted critical tribal services. The attack, which began on Sunday morning, crippled computer and phone systems across tribal operations, including health centers, businesses, and government services.Casino revenue—vital for funding community services—was halted entirely, with gaming operations suspended at all locations. The health division canceled all non-emergency medical appointments, including primary care, radiology, and dental services, while lab operations were severely limited. Tribal government services were reduced to minimal capacity, with cash-only transactions enforced at facilities like the Big Bear Arena. Hotel check-ins were suspended, gas services halted, and law enforcement unable to process new licenses.The attack also disrupted elder services, tribal stores, and administrative functions, with meetings canceled. While the tribe aims to restore systems within a week, the financial, operational, and reputational damage is extensive, affecting 44,000+ members, employees, and local economies dependent on casino revenue. Third-party cybersecurity experts were engaged, but the investigation remains ongoing, with limited public details available.
TPRM report: https://www.rankiteo.com/company/sault-ste-marie-tribe
"id": "sau817090225",
"linkid": "sault-ste-marie-tribe",
"type": "Ransomware",
"date": "2/2025",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"{'affected_entities': [{'industry': ['gaming (casinos)',
'healthcare',
'tribal services',
'retail',
'hospitality'],
'location': 'Michigan, USA',
'name': 'Sault Ste. Marie Tribe of Chippewa Indians',
'size': '44,000+ members',
'type': 'tribal government'},
{'industry': 'casino and hospitality',
'location': ['Manistique, MI',
'Christmas, MI',
'Hessel, MI',
'Sault Ste. Marie, MI',
'St. Ignace, MI'],
'name': 'Kewadin Casinos',
'type': 'business (gaming)'}],
'customer_advisories': ['cash-only transactions at affected locations',
'emergency-only healthcare services',
'suspension of non-emergency appointments',
'requirement for patients to bring medication lists '
'for emergency walk-ins'],
'date_detected': '2023-10-08T00:00:00Z',
'date_publicly_disclosed': '2023-10-09T00:00:00Z',
'description': "Michigan's largest tribal nation, the Sault Ste. Marie Tribe "
'of Chippewa Indians, experienced a widespread ransomware '
'attack that forced the closure of all five Kewadin Casino '
'locations and disrupted critical services, including health '
'centers and tribal businesses. The attack began on Sunday '
'morning, impacting computer and phone systems across tribal '
'operations. The tribe, which relies heavily on casino revenue '
'to fund community services, has suspended gaming operations, '
'cancelled medical appointments, and limited various other '
'services. Third-party experts have been enlisted to assist in '
'restoring operations, with an estimated resolution time of up '
'to a week or longer.',
'impact': {'brand_reputation_impact': 'high (disruption of critical services '
'and public disclosure)',
'downtime': {'end': None,
'estimated_resolution': 'up to one week or longer',
'start': '2023-10-08T00:00:00Z'},
'operational_impact': ['closure of all five Kewadin Casino '
'locations',
'suspension of gaming operations',
'cancellation of medical appointments '
'(primary care, radiology, dental)',
'limited lab services',
'cash-only transactions at Big Bear Arena '
'and tribal stores',
'unavailability of gas services',
'suspension of new inland hunting and '
'fishing license processing',
'cancellation of tribal government meetings',
'suspension of hotel check-ins (existing '
'guests permitted to stay)'],
'systems_affected': ['computer systems',
'phone systems',
'casino operations (Kewadin Casino locations: '
'Manistique, Christmas, Hessel, Sault Ste. '
'Marie, St. Ignace)',
'health centers (primary care, radiology, '
'dental)',
'tribal businesses',
'Big Bear Arena (payment systems)',
'tribal law enforcement (license processing)',
'hotel check-in systems',
'gas services',
'tribal stores (payment systems)']},
'investigation_status': 'ongoing (limited details shared publicly)',
'motivation': 'financial (presumed, based on ransomware attack pattern)',
'ransomware': {'data_encryption': True},
'references': [{'source': 'Tribal Business News'}],
'response': {'communication_strategy': ['public statements by Tribal Chairman '
'Austin Lowes',
'updates via tribal Facebook pages'],
'containment_measures': ['temporary closure of affected '
'departments and businesses',
'limitation of services to '
'emergency-only (e.g., healthcare '
'walk-ins)'],
'incident_response_plan_activated': True,
'recovery_measures': ['engagement of third-party experts to '
'restore operations'],
'third_party_assistance': True},
'stakeholder_advisories': ['public statement by Tribal Chairman Austin Lowes',
'updates via tribal Facebook pages'],
'title': 'Ransomware Attack on Sault Ste. Marie Tribe of Chippewa Indians '
'Disrupts Casinos and Critical Services',
'type': 'ransomware'}