Chanhassen Dinner Theatres cyberattack disrupts operations

Analyst assessment

DysruptionHub’s published report documented that Chanhassen Dinner Theatres took systems offline after detecting an attack on part of its network on May 15, 2026. The organization’s official update said it worked with outside experts, deployed a temporary system, and resumed performances on May 21.

Separately, DysruptionHub assesses with high confidence that the incident caused a material operational disruption. The Minnesota Star Tribune reported that computer and phone systems went down, food-and-beverage point-of-sale terminals could not communicate with kitchen systems, and the attack included a ransom note. The public record does not establish ransomware, encryption, data theft, payment, or a named threat actor.

Operational significance

The incident affected core customer-service and venue operations. Phone and internet failures made it difficult to communicate with patrons, and food-and-beverage systems could not operate normally. The theater relied on a small number of remote workstations and developed a temporary server environment to support reopening.

Several performances were canceled or rescheduled while the organization addressed both the cyberattack and a separate norovirus outbreak. The cyber incident was a stated factor in canceling May 19 and May 20 performances because the theater wanted its technical systems fully tested before audiences returned.

Disclosure posture

Chanhassen Dinner Theatres publicly acknowledged the network attack and issued repeated operational updates. Its statements identified the shutdown, outside-expert response, temporary-system deployment, reopening date, and continuing gift-card limitations. The organization did not disclose the ransom note, affected systems in technical detail, or whether customer or employee information was accessed.

Current status

The theater resumed performances and normal pub service on May 21 using a temporary system it described as fully operational, although gift cards issued more than six days earlier still could not be accepted. Its current official ticketing information again lists cash, cards and gift cards as accepted payment methods and says gift cards can be purchased online or at the box office and redeemed by phone for tickets or dining. That positive first-party service evidence supports a resolved operational status, although the organization has not published an exact date when every original system was restored or a final forensic conclusion.

Confidence and uncertainty

Confidence is high that malicious cyber activity affected the venue because the organization explicitly confirmed an attack. Confidence is high that phones, computer systems, point-of-sale functions, patron communications, and performances were affected.

The ransom note supports confirmed extortion activity, but it does not by itself prove ransomware or encryption. Data impact remains unresolved because no public source established whether payment-card data, ticketing records, customer information, employee information, or internal files were accessed or removed.

Analytic gaps

The reviewed sources do not establish the initial access vector, malware family, compromised account or device, encryption scope, dwell time, affected servers, backup impact, ransom amount, payment status, data-exposure scope, or threat actor. They also do not provide the exact date every original system was restored.