Ransomware attack disrupted Lower Sioux Indian Community casino and health services
- Organization
- Lower Sioux Indian Community
- Exploit
- Ransomware
- Industry
- Tribal Government
Systems across the Lower Sioux Indian Community in Morton, Minnesota began failing on 27 March 2025, starting with the Jackpot Junction Casino Hotel and spreading through the tribe's wider network. The Lower Sioux Government Center said it was addressing a ransomware event and had taken certain systems offline to contain the activity.
The disruption reached well beyond gaming. Slot machines, kiosks and hotel systems went down, bingo was cancelled and the Dacotah Dining restaurant closed, while table games and bars stayed open. Tribal government phone, fax and email services were unavailable and government offices closed early, and the health centre, dental clinic, optical service and pharmacy lost communications. The health centre and the Head Start early education programme published temporary phone numbers, and pharmacy patients were directed to an app.
Community council president Robert Larsen confirmed unauthorised access to certain systems on 1 April. The tribe said it had activated its incident response protocols and engaged outside specialists, with the aim of restoring normal operations safely.
The RansomHub group claimed responsibility, which the Marshall Independent placed on 31 March and The Record reported in the days that followed. The Record noted it was the second known RansomHub attack on a tribal nation in 2025, after the Sault Ste. Marie Tribe of Chippewa Indians in February. The community, which has about 982 members, had not said whether personal data was taken.