Skip to content
DysruptionHub
Sign in Subscribe

Virgin Islands Lottery ransomware attack

Summary

Virgin Islands Lottery logo

A March 17, 2025, ransomware attack encrypted Virgin Islands Lottery systems across both operating districts, halting ticket sales, prize claims and drawings. The agency rebuilt records manually and refused a reported $1 million demand. Drawing1047 took place April28; May30hearing reporting described90%functionality. The exact final recovery date and responsible actor remain unverified.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Confirmed

Attack mechanisms

  • Ransomware

    Malware that encrypts systems or data, typically accompanied by a ransom demand.

  • Unauthorized access

    Unauthorized access to systems, accounts, networks, or data.

Data impacts

  • Data encryption

    Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Complete service outage

    A primary service, system, platform, or operational capability became entirely unavailable.

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Phone service disruption

    Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Payment processing disruption

    The organization could not process, receive, issue, reconcile, or record payments normally.

  • Transaction processing disruption

    Business, financial, customer, administrative, or operational transactions could not be completed normally.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Records processing disruption

    The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.

  • Scheduling disruption

    Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.

  • Government services disrupted

    Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.

  • Retail operations disrupted

    Store, dealership, point-of-sale, inventory, fulfillment, or other retail operations were materially affected.

  • Facility closure

    One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

  • Customer or public access restricted

    Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.

  • Downstream organization impact

    The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.

Extortion indicators

  • Ransom demand

    The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.

  • Encryption-based extortion

    The extortion activity involved unauthorized encryption of systems or data, with restoration or decryption conditioned on payment.

  • Payment denied

    An authoritative source stated that no ransom or extortion payment was made.

Incident narrative

Analyst assessment

A confirmed ransomware attack disrupted Virgin Islands Lottery systems March 17, 2025. The agency’s original announcement suspended operations, including ticket sales and prize claims, and further postponed drawing 1047. An earlier air-quality closure at the St. Thomas office was a separate problem.

In legislative testimony presented May 30, Executive Director Raymond Williams confirmed encryption across both operating districts and a $1 million demand to recover information. Phones, computers, servers and software were affected. Staff rebuilt records from paper receipts and prize-payment documents after usable backup information proved insufficient. The testimony confirms ransomware and encryption-based extortion; it does not identify a ransomware family or prove data exfiltration.

Operational significance

The shutdown interrupted the lottery’s core public services and affected dealers who depended on ticket sales. The initial reporting also described unavailable administrative functions. Office closures and delayed drawings extended the disruption beyond an internal technology problem.

A March 31 update anticipated completing data restoration around April 2, followed by testing. That target did not establish recovery: an April 23 statement still reported suspended operations while records audits and point-of-sale testing remained unfinished.

An April 27 report announced plans for the delayed drawing April 28 and public reopening April 29. The director’s later testimony confirms the drawing actually took place April 28. By the May 30 hearing, the lottery could operate again, although rebuilding work continued.

Confidence and uncertainty

Confidence is high in the cyber cause, encryption, ransom demand and operational disruption because the record includes the agency’s original statement and its director’s detailed account. Organization-origin cyber acknowledgment and disruption disclosure were both public March 17.

May 31 reporting on the hearing described roughly 90% functionality, refusal to pay the demand and an estimated $1.4 million in lost revenue. Payment refusal is the director’s reported position. The exact date of complete restoration is unknown; April 29 was an announced reopening date rather than proof that all systems had recovered. The historical incident is assessed as presumed resolved, with no verified exact end date.

Analytic gaps

The intrusion route, full technical findings, final restoration date and any data theft remain unverified. A Play listing located during claim searches dates to February 2024 and concerns the earlier incident; it is not evidence of responsibility for this attack. Searches of current and historical domains and supported name variants found no separately verified 2025 actor claim.

Organizations involved

Impacted locations

  • Saint Croix District, U.S. Virgin Islands

    Original March17letterhead lists6,7&8ASunnyIsleShoppingCenter and current officialcontact page confirms suites6,7,8A with Christiansted postaladdress. Director confirms StCroixsystems affected. SunnyIslepostalChristiansted is not proof of city containment; reuse canonicalSaintCroixDistrict as conservative physicalsiteanchor, not mislabeledduplicateStCroixislandrecord. Existingdistrictprofile requires postcreationrepair.

    Source

  • St. Thomas County, U.S. Virgin Islands

    The original March17letterhead places the StThomas office at3081KronprindsensGade, and the current officialcontact page https://www.winvilottery.com/contact lists81CC&81DKronprindsensGade plus the3081footer. The director’s testimony confirms systems affected in both operatingdistricts. Use the existing StThomascounty-equivalent as a conservative physicaloffice anchor; no municipality containment is inferred from postal wording. Existingrecord has erroneous islandOSMclassification and blankprofile; reviewed postcreation repair is mandatory before completion.

    Source

  • U.S. Virgin Islands

    The official governmentlottery operates throughout theU.S.VirginIslands, and its originalannouncement/director testimony describe suspension across both operatingdistricts. Pair territorialservice_area and impacted_area as the agency’s geographicremit. This doesnotmean everyresident,otheragency,business orislandsite experienced anoutage.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.