Ransomware shut Kewadin Casinos and Sault Tribe services across Michigan

The Sault Ste. Marie Tribe of Chippewa Indians, the largest federally recognised tribe in Michigan with more than 44,000 members, was hit by ransomware on the morning of Sunday, February 9, 2025. Chairman Austin Lowes said the attack affected multiple computer and phone systems across tribal administration, including the casinos, health centres and various businesses.

Gaming stopped at all five Kewadin Casino locations, in Sault Ste. Marie, St. Ignace, Manistique, Christmas and Hessel, from 7am on Monday, February 10. Hotel check-ins were suspended although existing guests could stay. MidJim convenience stores closed, tribal shops moved to cash only, fuel sales were unavailable and inland hunting and fishing licence processing halted. Health centres cancelled non-emergency primary care, radiology and dental appointments while continuing to accept emergency walk-ins.

Tribal government remained open in a limited capacity. Anishinaabek Community and Family Services, Education, Elder Services, Language and Culture, Tribal Court and law enforcement continued to operate, with court hearings moved to Zoom and temporary telephone numbers published on the tribe's Facebook pages.

The tribe engaged outside cyber security experts. On February 14 Lowes said measurable progress had been made but that the tribe expected to operate at limited capacity for up to another week, and that details could not be shared while the incident was ongoing. On February 15 the RansomHub group listed the tribe on its leak site, claiming it had taken 119GB of data and threatening to publish within three days.