Unauthorized network access July 16–27, 2026, accompanied a prolonged Kenaitze Indian Tribe computer and communications outage affecting health and public services. The Tribe began notifications Sept. 25 about possible exposure of personal and health information. Regular phone numbers resumed by Sept. 15, but full restoration and The Gentlemen’s responsibility remain unconfirmed.
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Unauthorized access to systems, accounts, networks, or data.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Internal or external network connectivity was unavailable or materially impaired.
The organization lost or materially restricted internet connectivity.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The Kenaitze Indian Tribe experienced unauthorized network access July 16–27, 2026, and a prolonged disruption to computers and communications. Its Sept. 25 notification said suspicious activity was discovered July 27 and files may have been accessed or downloaded. This establishes network intrusion, but not ransomware or confirmed exfiltration.
Ransomware.live preserved The Gentlemen’s July 31 claim. The Tribe acknowledged an unknown actor’s claim without attributing the incident to that group. The notification does not resolve responsibility.
KDLL documented limited health and elder services and temporary contacts for education, transit and social services. Normal computers, internet, email and phones were disrupted. Workarounds maintained access to important programs without establishing normal operating capacity. No interruption to emergency response or physical transit operation is established.
The Tribe’s July 30 service post, edited Sept. 15, instructed users to resume regular department numbers. That supports phone-service improvement, not complete restoration of every system.
The Tribe’s July 31 statement linked the outage to a cybersecurity incident and external assistance. Its Sept. 25 notice identified a July 16–27 access window and began individual notifications. Potentially involved information included names, Social Security and identification numbers, financial account details, birth dates and medical and insurance information. It did not establish that every listed category affected every notified person.
The latest supported operational-impact observation remains Sept. 14. The subsequent regular-number instruction shows partial recovery; no dated full restoration is established. The Sept. 25 data notice is not a new operational-outage observation. No newer dated operational disruption or complete restoration has been established.
As of Oct. 19, the incident is presumed resolved because 35 days have passed since the latest supported operational-impact observation and no newer continuing disruption was established in the review. This is an assessment of operational status, not confirmation of complete restoration. The exact restoration date remains unknown.
Confidence is high in cyber involvement and documented disruption because the Tribe directly acknowledged both. Its investigation confirms unauthorized network access; possible file access or download creates a confidentiality concern but does not establish definite theft. Ransomware and The Gentlemen attribution remain low-confidence claim-level assessments. No confirmed encryption or ransom demand is established.
The initial access method, compromised systems, affected-person count, actual files accessed or copied, restoration date and actor identity remain unresolved. Removal of the homepage outage notice does not establish full recovery. The available evidence does not resolve whether The Gentlemen directly participated or claimed information acquired elsewhere.
Ransomware.live recorded a The Gentlemen leak-site claim against the Kenaitze Indian Tribe. The Tribe acknowledged that an unknown actor had claimed responsibility and said the claim was under investigation, but it did not confirm The Gentlemen, ransomware, data theft or a ransom demand.
Kenai is the Tribe’s administrative base; programs also serve the wider Kenai Peninsula.
We reported that a cybersecurity incident had disrupted the Tribe’s phones, email and computers for more than a week, forcing temporary phone lines and service limits. Ransomware.live attributed the incident to The Gentlemen, while the Tribe had not confirmed ransomware, data theft or a ransom demand.
An explicit Sept15 edit instructs users to resume regular department phone numbers. Original July30 text describes prolonged computer, phone and email outages, limited services, temporary phones and difficulty notifying canceled appointments.
The Kenaitze Indian Tribe said it connected a prolonged technical outage to a cybersecurity incident, enlisted external experts, and was aware that an unknown actor had claimed responsibility. The Tribe said the claim was part of its investigation and that the ongoing matter limited additional detail.
Ransomware.live recorded that Kenaitze Indian Tribe was claimed by the Thegentlemen ransomware group and listed the claim as discovered on July 31, 2026 at 18:30 UTC. The page identifies kenaitze.org and the United States, but the listing is an actor claim rather than victim confirmation.
KDLL reported that the Tribe was in its second week of disrupted internet service, had first reported internet and phone outages in late July, and later linked the outages to a cybersecurity incident. The report documented temporary phone numbers, limited wellness and elder services, and the communications manager’s decision not to provide further detail.
The Tribe’s homepage said it continued working with external experts to resolve a technical outage and could not provide additional details while the matter remained ongoing.
Tribe confirmed unauthorized network access July16–27, detected July27; files may have been accessed or downloaded. Potentially involved information includes names, Social Security/ID numbers, financial accounts, birth dates, medical and insurance information. Individual notifications began Sept25.
As reviewed Sept. 2, the Tribe’s official website said work continued to resolve the technical outage and listed temporary numbers for primary care, behavioral health, dental care, education, transit, housing and family and social services.
Signed-in members can report an error, update, or missing source.
