Sault Ste. Marie Tribe of Chippewa Indians

Summary

A ransomware attack on the Sault Ste. Marie Tribe of Chippewa Indians disrupted the tribe's phone and computer systems, affecting healthcare services, government operations, and tribal businesses, including all five Kewadin Casinos in the Upper Peninsula. The casinos were closed for more than two weeks before gradually reopening, with the Sault Ste. Marie and St. Ignace locations resuming operations first and the remaining three reopening shortly after. The tribe refused to pay the financial ransom demanded by the cyber criminals, citing guidance from law enforcement and cyber experts, and was able to restore systems and recover data independently. Tribal convenience stores mostly returned to full operation, while the organization continues reviewing hundreds of thousands of stolen documents and offering affected people free credit monitoring services. An FBI investigation into the incident remains ongoing.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 9, 2025, a cyberattack struck the Sault Ste. Marie Tribe of Chippewa Indians, targeting the tribe's phone and computer systems. The attack disrupted multiple sectors of tribal operations, including healthcare services, government operations, and tribal businesses. All five Kewadin Casinos in Michigan's Upper Peninsula, which are owned and operated by the tribe, were forced to close for more than two weeks as a result of the incident. The Sault Ste. Marie and St. Ignace casino locations were the first to resume operations, followed by the casinos in Manistique, Christmas, and Hessel, which reopened on Monday, March 3 at 12 p.m. Tribal convenience stores located at four of the five casinos were also affected by the attack; according to a release from the tribe, these stores were mostly running at full operation by the time the casinos began to reopen. Some tribal organizations were impacted more severely than others and were still in the process of recovering from the disruption.

In a February 28 post, Sault Tribe Chairman Austin Lowes confirmed that the incident was a ransomware attack involving extortion. The cyber criminals had attempted to extort a ransom from the tribe in exchange for their stolen data, but the tribe decided not to pay the financial demand. This decision was made with guidance from law enforcement and cyber experts after the tribe was able to restore its systems and recover its data. Lowes explained the rationale, noting that there was no guarantee the tribe would have received what was promised by the attackers, and that paying the ransom could have still resulted in the data being shared on the dark web. The tribe subsequently began reviewing hundreds of thousands of documents of stolen information and committed to reaching out to affected individuals to set up free credit monitoring services.

The broader community impact was felt throughout the Eastern Upper Peninsula. Tony Haller, the Executive Director of the Sault Ste. Marie Area Chamber of Commerce, identified the loss of revenue for the tribe as the biggest impact of the incident. Haller also noted that while he had not yet seen a trickle-down effect from the casino shutdowns, he anticipated potential impacts on other businesses through the cancellation of reservations and related economic activity. The Sault Tribe Board of Directors meeting scheduled for May 4 was cancelled as a consequence of the ongoing situation, with updated information directed to be available on the tribe's website. An FBI investigation into the ransomware attack remained ongoing following the reopening of the casinos and the tribe's refusal to pay the ransom.

Sources

Sources available to members: 1 source.