Unauthorized access disrupted Jackpot Junction Casino Hotel and Lower Sioux tribal services in March 2025. Phones were unavailable March 27, and the council president acknowledged a cyber incident March 31. Healthcare communications were restored by an April 7 update; the casino announced its return April 11. Ransomware group claims remain unverified, and the exact final recovery date across all affected systems is unknown.
Unauthorized access to systems, accounts, networks, or data.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
The organization lost or materially restricted internet connectivity.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.
Unauthorized access to systems associated with Jackpot Junction Casino Hotel disrupted casino operations and services of the Lower Sioux Indian Community in late March 2025. Council President Robert “Deuce” Larsen acknowledged the cybersecurity incident March 31, saying response measures included taking systems offline and engaging outside experts. This organization-origin statement establishes cyber involvement; it does not identify encryption, an entry route or a responsible group.
The casino reported unavailable phone lines March 27. That is the first verified operational effect in this review, not an established intrusion date. Its subsequent slot-floor closure notice described technical problems while other amenities remained available.
The disruption affected gaming, hotel reservations, bingo, promotional activities and communications. The casino’s closure notice said bars, restaurants and table games remained open at that stage. April 2 local reporting subsequently documented the Dacotah Dining closure, unavailable slot machines and kiosks, canceled bingo and impaired bookings. These time-specific accounts support changing, partial availability rather than an uninterrupted closure of every casino service.
The effects extended to tribal government and health services. The health center’s original April 2 notice documented offline tribal phones, fax and email, and supplied temporary patient contact routes and a prescription-refill alternative. It expressly said the health center building remained open for normal hours. Communications disruption therefore does not establish that the clinic closed or that all patient care stopped. Our Ghost intake article also described alternative messaging for the tribal Head Start program.
The health center’s web update, originally dated April 2 and explicitly updated April 7, reported restored healthcare communications. The casino’s April 11 announcement confirmed its casino floor, hotel, dining and bingo were operating again. It also described rescheduled promotions. These are positive recovery milestones, but neither provides an exact final restoration date for every affected tribal system.
The incident and material operational effects are well supported. RansomHub listed the casino’s domain as an alleged victim, and Comparitech reported an unspecified ransom and a one-month deadline. A later LockBit3 listing names the same domain. Neither listing independently verifies encryption, data theft, payment or responsibility. The later listing does not establish a separate attack.
The trackers discovered these claims March 31 and April 16, respectively; their original publication times remain unknown. The reviewed evidence does not establish the exact order of the first external cyber characterization and Larsen’s March 31 acknowledgment, so the cyber-transparency sequence requires review.
The initial access method, intrusion date, full data impact, actor identity, payment outcome and response costs remain unknown. The precise final recovery date across casino and tribal services is also unverified. Operational status is presumed resolved, supported by the documented recovery milestones and the age of the incident, without treating a threat-actor deadline or claim-discovery date as an outage end. The casino’s Morton mailing address does not itself establish municipal containment; tribal jurisdiction and physical site geography require separate verification.
A later LockBit3 listing identifies the same casino domain. April16 is tracker discovery, not verified original publication. Public evidence does not establish whether this was republication, shared affiliate activity or another circumstance. It does not prove a second attack, encryption, data theft, payment or LockBit responsibility.
RansomHub listed the casino domain as an alleged victim. Original Comparitech reporting described an unspecified payment amount and a one-month deadline. Tracker discovery March31 is not original publication; its exact order relative to the council president’s March31 acknowledgment remains unknown. The claim does not verify encryption, theft, payment or causal responsibility.
The official council page establishes tribal governmental authority over the reservation. Pair this geographic service remit on the tribe and incident. The exact federal Census polygon is researched but awaits a separate Ops submission after this unmapped record is created. Once mapped and verified, add spatial relationships to both Redwood and Renville counties; the polygon has no overlap with Morton city. This overlay does not assert a uniform outage across the reservation or county/state administrative authority over it.
Physical site anchor for the affected tribal administration, Jackpot Junction and health center in Redwood County. Official tribal pages place the community south of Morton; official casino and clinic map points independently resolve to Redwood County and Paxton Township, outside an incorporated place. This relationship does not assert a Redwood County government outage.
Signed-in members can report an error, update, or missing source.
