RansomHub ransomware group lists saulttribe.com/kewadin.com on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Hospitality
• Announcement date: February 15, 2025

The ransomware group known as RansomHub has announced a significant data breach targeting Kewadin Casinos and the Sault Tribe of Chippewa Indians. According to a post on the group's leak site announced on February 15, 2025, the threat actor claims to have successfully exfiltrated a substantial amount of sensitive information belonging to the organization.

Details of the claimed attack

RansomHub claims that the organization's computer infrastructure has been locked by the attackers. In addition to the encryption of systems, the group asserts that they have exfiltrated 119 GB of data, which reportedly consists of 501,211 files. The threat actor stated that they attempted to engage in negotiations with the organization's management, but these attempts were unsuccessful.

To increase pressure on the victim, the group has published the email addresses of the organization's board members. Furthermore, the group has specified a deadline for negotiations to be conducted. This pattern of behavior is consistent with modern ransomware operations that utilize public pressure to force a victim into compliance.

The data allegedly exfiltrated

The information allegedly stolen by the threat actor is diverse and contains highly sensitive categories of data. According to the group's claims, the stolen files include:

• Personal data
• Health records
• Employee data
• Insurance information
• Administrative documents

Organization profile

Kewadin Casinos is an enterprise owned and operated by the Sault Ste. Marie Tribe of Chippewa Indians. The organization provides casino and hotel services at various locations in Michigan. As a tribal business, it operates within the regional tourism and entertainment sector.

Analysis and potential impact

This breach may increase the risk of identity theft and targeted phishing attacks for individuals associated with the organization. The presence of health records could trigger legal processes under HIPAA regulations in the United States. Additionally, the targeting of the organization's insurance providers may be interpreted as a secondary extortion attempt.

RansomHub is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024 and is reported to have ties to ALPHV. Given this background, it is suggested that the group employs double extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release if a ransom is not paid.

This type of attack can significantly impact an organization's operational continuity and reputation. For organizations operating in the hospitality and tourism sectors, such incidents can lead to a loss of consumer trust and complex regulatory challenges. To defend against such threats, organizations typically focus on robust backup strategies, network segmentation, and continuous monitoring to detect unauthorized data movement. Implementing strong access controls and multi-factor authentication is also a standard defensive measure to mitigate the risk of initial access and lateral movement within a network.