Claim details
Rhysida claimed the tribes and demanded 10 bitcoin; the tribe did not confirm attribution.
Cheyenne and Arapaho Tribes cyber disruption
Summary
An attempted cyber intrusion identified about Dec. 8, 2025, led the Cheyenne and Arapaho Tribes to take systems offline, disrupting government communications and education administration. Rhysida later claimed the incident and demanded 10 bitcoin; ransomware deployment and data theft remain unverified.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
DD-CIT assessment
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Email disruption
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Educational operations disrupted
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Extortion indicators
-
Ransom demand
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
-
Encryption-based extortion
The extortion activity involved unauthorized encryption of systems or data, with restoration or decryption conditioned on payment.
-
Data-theft extortion
The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.
-
Public leak threat
The actor explicitly threatened to publish or publicly release victim data or incident details.
-
Leak-site listing
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
-
Countdown or payment deadline
The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.
-
Direct victim contact
The actor directly contacted the victim through a ransom note, email, chat portal, telephone call, messaging platform, or other communication channel.
-
Payment denied
An authoritative source stated that no ransom or extortion payment was made.
Incident narrative
Analyst assessment
We first reported the December 2025 incident in the CTI sphere on Feb. 17, 2026. The tribe’s Jan. 2, 2026 update confirms that IT identified an attempted cyber intrusion on or about Dec. 8, 2025, and leaders took tribal systems offline as a precaution. The update did not confirm ransomware, data loss or that every system was compromised. Rhysida claimed the tribes on Feb. 17, 2026, and demanded 10 bitcoin; the public record does not independently verify the actor, encryption or theft.
Operational significance
The shutdown disrupted tribal computers, email, phones and education administration. The tribe said about 80% of employee users at its Concho headquarters had their systems restored by Jan. 2, with remaining systems returning in phases. Alternate phone arrangements were reported in February. The documented facility municipality is Concho in Canadian County, Oklahoma; public references to Clinton do not establish a separately impacted facility.
Conflation of two incidents
The Record’s report attributed Governor Reggie Wassana’s ransomware and no-payment statement, including a promise to keep Lucky Star Casino employees paid, to the December 2025 tribal network incident. Those remarks concerned the separate June 2021 Lucky Star casino attack. A Jan. 29, 2023 archive of the government page shows that the statement page predates the December 2025 incident. Its linked PDF was created June 22, 2021, and reporting published that July documents the same language and casino-pay detail. The Tribal Tribune reported in June 2021 that tribal government offices were unaffected by the casino attack.
Confidence and uncertainty
Confidence is high in a cyber-related precautionary shutdown and phased recovery because the tribe described both. Ransomware involvement is suspected based on Rhysida’s claim, but no reviewed 2025 tribal statement confirms encryption, data theft or a ransom-payment decision.
Disclosure posture
The Jan. 2 tribal release acknowledged cyber involvement and documented the intentional shutdown and recovery, supporting organization-confirmed cyber and disruption transparency.
Current status
The incident is presumed resolved because most Concho users were restored by early January and no continuing material outage was located, although no final all-clear date was published.
Analytic gaps
The public record does not establish initial access, which systems if any were compromised or encrypted, whether any data were stolen, whether Rhysida’s claim is authentic, or the final restoration date.
Threat actor and claim
Organizations involved
Cheyenne and Arapaho Tribes
Locations
Organization type
Critical infrastructure
Impacted locations
Sources
DysruptionHub first reported the December network disruption in the reviewed CTI coverage and documented the tribal Jan. 2 release and Rhysida’s later claim.
The tribe identified an attempted cybersecurity intrusion about Dec. 8, 2025, took systems offline as a precaution, reported no confirmed data loss and said roughly 80% of Concho headquarters users were restored by Jan. 2.
Rhysida listed the tribes, demanded 10 bitcoin and alleged stolen data.
The Feb. 18 report credited DysruptionHub’s Feb. 17 coverage and noted that Rhysida had not published proof of its data claim.
The Record incorrectly attributed Governor Reggie Wassana’s June 2021 Lucky Star casino ransomware and no-payment remarks to the December 2025 tribal network incident.
See something that needs correction?
Signed-in members can report an error, update, or missing source.