United Keetoowah Band of Cherokee Indians in Oklahoma listed by Rhysida ransomware group

• Ransomware group: Rhysida
• Country: United States
• Sector: Government & Defense
• Announcement date: December 12, 2025

The Rhysida ransomware group has officially listed the United Keetoowah Band of Cherokee Indians in Oklahoma on its dedicated leak site. This announcement, made on December 12, 2025, follows the group's claim that they have successfully breached the organization's systems and obtained data.

Details of the claimed attack

According to the announcement posted by the threat actor, the Rhysida group claims to have gained unauthorized access to the internal systems of the United Keetoowah Band of Cherokee Indians in Oklahoma. The group asserts that during this intrusion, they were able to obtain data belonging to the organization. The publication of this notice on the group's leak site marks a significant escalation in the incident, as it introduces the immediate risk of the organization's sensitive information being leaked publicly.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their victims. By publicly listing an organization, these groups aim to damage the victim's reputation and create urgency for a ransom payment. This tactic is a hallmark of modern cyber extortion, where the threat of data exposure is used as a primary lever for negotiation.

Information regarding compromised data

Despite the group's claims of a successful breach, the current listing provides very limited information regarding the specific contents of the stolen information. There is no information available regarding the nature of the leaked or compromised data, and no screenshots of the stolen files have been provided by the attackers to verify their claims. Furthermore, the group has not disclosed the total size of the data or the specific number of files involved in the incident.

About the United Keetoowah Band of Cherokee Indians

The United Keetoowah Band of Cherokee Indians is a federally recognized Native American tribe based in Oklahoma. The organization operates as a self-governing entity with a focus on the welfare of its tribal members. Its primary responsibilities include the preservation of cultural heritage and the administration of various tribal services to its community.

Risk assessment and implications

This incident may present a significant risk of sensitive data exposure for the organization. Given the established patterns and past activities of the Rhysida group, it is expected that they may apply pressure on the organization through double extortion tactics. Double extortion is a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release if a ransom is not paid.

Attacks targeting government and public sector entities, such as this one, can lead to severe consequences, including identity theft and significant operational disruptions. For organizations in the government and defense sector, such breaches can undermine public trust and disrupt essential services. Additionally, the organization may face complex legal obligations under various US state and federal data protection regulations following such a breach.

The Rhysida group has been known to be active since 2023 and has a history of targeting similar public sector entities. To mitigate such risks, organizations in this sector often prioritize defensive measures such as implementing multi-factor authentication, maintaining robust backup systems, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.