Cyberattack Forces Shutdown at Lower Sioux Casino in Minnesota

A ransomware attack has disrupted operations at Jackpot Junction Casino Hotel in Morton, Minnesota, leading to the shutdown of slot machines and widespread outages across the Lower Sioux Indian Community. The attack began on March 27, 2025, and has impacted hotel reservations, bingo nights, and communication systems, including the casino’s phone lines. Robert “Deuce” Larsen, president of the Lower Sioux Indian Community Council, confirmed the incident and said the casino is working with cybersecurity experts. RansomHub, a prolific ransomware gang believed to operate from Russia, claimed responsibility for the intrusion and posted the casino on its dark web leak site.

The breach has disrupted not only casino operations but also critical tribal services. The Lower Sioux Head Start program and health care center have experienced communication issues, forcing staff to use alternative messaging systems. RansomHub, which uses a ransomware-as-a-service model, has been linked to several high-profile attacks globally and has claimed hundreds of victims since early 2024. Although it is unclear if any data was stolen or a ransom paid, the attack underscores growing threats against tribal and hospitality sectors. Despite the digital shutdown, the casino’s restaurants and live entertainment venues remained partially operational.