Skip to content
DysruptionHub
Sign in Subscribe

Sault Tribe ransomware disrupts government and businesses

Summary

Sault Ste. Marie Tribe of Chippewa Indians logo

A Feb. 9, 2025, ransomware attack disrupted Sault Tribe government systems, health services, casinos and stores. Casinos reopened in stages through March 3, while health services still had limitations in March. The tribe refused a ransom demand and later notified individuals about potentially compromised personal information. RansomHub’s attribution claim remains unconfirmed.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted location

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
High
Attribution:
Low

Attack mechanisms

  • Ransomware

    Malware that encrypts systems or data, typically accompanied by a ransom demand.

Data impacts

  • Data theft or exfiltration

    Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

  • Data publication or leak

    Stolen, exposed, or otherwise compromised data was publicly released, posted, distributed, or offered for download.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Phone service disruption

    Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

  • Website unavailable

    A public-facing website was unavailable, disabled, or inaccessible.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Payment processing disruption

    The organization could not process, receive, issue, reconcile, or record payments normally.

  • Records processing disruption

    The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.

  • Healthcare operations disrupted

    Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.

  • Government services disrupted

    Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.

  • Retail operations disrupted

    Store, dealership, point-of-sale, inventory, fulfillment, or other retail operations were materially affected.

  • Facility closure

    One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.

  • Event or activity cancellation

    Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Alternate service channel required

    The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

  • Customer or public access restricted

    Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.

Extortion indicators

  • Ransom demand

    The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.

  • Data-theft extortion

    The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.

  • Payment denied

    An authoritative source stated that no ransom or extortion payment was made.

Incident narrative

Analyst assessment

A ransomware attack discovered Feb. 9, 2025, disrupted the Sault Ste. Marie Tribe of Chippewa Indians’ government, health services and businesses in Michigan’s Upper Peninsula. The tribe shut down systems to contain the incident and engaged outside cybersecurity and legal specialists and law enforcement. Its original service bulletin, dated Feb. 10, acknowledged ransomware and described limited operations across affected departments.

Operational significance

All Kewadin gaming operations were halted beginning Feb. 10. MidJim stores closed after initially offering restricted cash-only purchases, enrollment could not print membership cards, and new inland hunting and fishing licenses could not be processed. The bulletin also identified services that remained operational, including education, elder services and tribal court functions. The disruption was extensive but did not stop every tribal service.

The Feb. 19 tribal newspaper documented limited health services, replacement telephone contacts and an unavailable tribal website. Patients faced changes in access to medical and pharmacy services while some care continued.

Recovery was phased. A Feb. 25 release announced casino reopenings in Sault Ste. Marie on Feb. 26, St. Ignace on Feb. 28, and Manistique, Christmas and Hessel on March 3. The March 19 newspaper confirmed those reopenings and normal MidJim hours, while reporting that the Health Division still operated with limitations and temporary telephone numbers.

Confidence and uncertainty

Victim statements establish ransomware and service disruption with high confidence. The tribe said it refused a ransom demand after recovering systems and data and considering the uncertainty that payment would prevent disclosure. It reviewed hundreds of thousands of documents to determine whose information was affected; that document volume is not an affected-person count.

Comparitech reported Feb. 17 that RansomHub claimed the attack and alleged 119 gigabytes of stolen data. The actor identity and volume remain unconfirmed by the tribe. Separately, a Feb. 21 update from My UP News quoted the chairman acknowledging that information belonging to himself, relatives and other individuals had been leaked.

The tribe’s formal breach notice, updated Sept. 4, said letters were mailed Aug. 28 with 12 months of identity protection. Potentially affected information varied by person and included identity, medical and insurance information, with financial-account or passport details in a limited number of cases. The notice reported no evidence of misuse at that time.

Analytic gaps

The entry method, total affected population, ransom amount and incident-specific financial losses remain unverified. Casino reopenings do not establish full health-service restoration. Operational status is presumed resolved, but the exact final restoration date is unknown. The identity-notification process is tracked separately from the period of service disruption.

Threat actor and claim

RansomHub

Listed as: Sault Ste. Marie Tribe of Chippewa IndiansSource: Comparitech

Claim details

Comparitech’s Feb. 17, 2025, report says RansomHub listed the tribe over the preceding weekend, alleged theft of 119 gigabytes and threatened publication by Feb. 19. The tribe had not confirmed the group’s claim. Its later acknowledgments of ransomware, stolen or leaked information and a refused ransom demand do not independently verify RansomHub’s responsibility or the alleged volume. Exact original claim publication and tracker discovery timestamps remain unknown; the article’s update date is not substituted for either.

Organizations involved

Impacted location

  • Sault Ste. Marie, Michigan

    Sault Ste. Marie is the verified administration-office municipality and one location of affected tribal services. The original chairman’s statement identifies disrupted tribal systems and operations. This city relationship is a physical anchor, not the extent of tribal jurisdiction or the incident’s entire geographic reach.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.