The United Keetoowah Band of Cherokee Indians in Oklahoma reported an IT issue Dec. 4, 2025, that delayed services across tribal offices, including tag services and suboffices. Its Stilwell office later closed for a day. Rhysida listed the tribe as a purported victim Dec. 12, but the tribe did not confirm a cyberattack, ransomware or a connection to the disruption.
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
DysruptionHub assesses with medium confidence that the United Keetoowah Band’s December IT disruption may have been cyber-related. Our Dec. 12 report documented the tribe’s Dec. 4 post identifying an IT issue and service delays across offices, plus a later Rhysida victim listing. The listing is an external allegation, not proof of ransomware or a causal link. The tribe had not issued a formal cyber-incident statement in the reviewed material.
The tribe said tag services and suboffices were delayed while it worked to restore systems. It said Echota Behavioral Health and other health programs were not affected. A later notice said the Stilwell suboffice would close Dec. 12, but the reviewed statement did not expressly link the closure to the IT issue; the record does not count it as a confirmed cyber-caused closure.
On Dec. 4, the tribe said it had found the source of the IT issue and expected restoration within days. No reviewed official statement confirms a final restoration date or explains the cause. This retrospective record is presumed resolved without a verified all-clear.
The tribe’s own post confirms operational service delays. The cyber connection rests on temporal proximity to the Rhysida listing and remains uncertain. Ransomware, data theft, extortion and actor attribution are not treated as confirmed.
The cause of the IT issue, its relationship to the Rhysida claim, affected systems, any data impact and final restoration date remain unresolved.
Rhysida listed the United Keetoowah Band as a purported victim, as recorded by ransomware.live and our Dec. 12 report. The tribe confirmed IT service delays but has not confirmed a cyberattack, ransomware, data theft or a connection between the listing and those delays.
Stilwell suboffice closed Dec. 12, but a causal link to the IT issue was not confirmed.
Tahlequah headquarters is a physical anchor for the affected tribal government; no office-specific outage is asserted.
Mapped HIFLD/BIA Cherokee Tribal Statistical Area is a geographic proxy for the tribal service remit; it is not a legal jurisdictional boundary or evidence of regionwide outage.
We reported the tribe’s Dec. 4 IT issue and delays to tag services and suboffices, as well as an unverified Rhysida listing and a later Stilwell office closure.
The tribe said it had identified the source of an IT issue and was working to restore systems; tag services and suboffices faced delays while health programs were not impacted.
Signed-in members can report an error, update, or missing source.
