Loading story…
The Cheyenne and Arapaho Tribes (a federally recognized tribal government headquartered in Concho, Oklahoma) reported a ransomware incident that forced shutdown of tribal computer networks and disrupted critical services, including email and phone systems, with the impact extending to tribal operations and schools. Tribal officials said the intrusion activity was detected in early December 2025, systems were taken offline as part of containment, and recovery proceeded with support from an insurance provider and involvement from federal authorities; the tribal governor publicly stated the tribe did not negotiate or pay.
The Rhysida ransomware group subsequently claimed responsibility and listed the tribe on its leak/auction site, demanding 10 BTC (reported as roughly $660,000) in exchange for not releasing allegedly stolen data. Reporting noted that while Rhysida’s listing set a 10 BTC price and an auction countdown, it did not clearly provide proof of data theft in the public post, and attribution was not uniformly confirmed by authorities at the time of publication; however, Rhysida publicly took credit and threatened data leakage as part of the extortion attempt.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Governor Reggie Wassana publicly said the tribe would not negotiate with or pay the attackers, describing the incident as a 'terrorist attack.' He also confirmed that the tribes had been targeted and that recovery work was underway.
The Rhysida ransomware group listed the Cheyenne and Arapaho Tribes on its leak or auction site, demanding 10 bitcoin to prevent release of allegedly stolen data. Reports said the posting included a six-day countdown but no proof of compromise or details on the data.
As the tribes worked to restore systems, they involved federal authorities in the investigation and coordinated recovery with their insurance provider. Tribal leadership said response and recovery efforts were ongoing.
Operational impacts from the ransomware incident persisted into January, with schools and government services still affected. The Department of Education reported outages and said students would not be penalized for assignment delays caused by the disruption.
Following the intrusion, tribal officials shut down computer networks to contain the incident, disrupting email, phone, internet, schools, and other critical systems. Some tribal operations were temporarily suspended while recovery began.
The Cheyenne and Arapaho Tribes in Oklahoma first detected intrusion activity tied to a ransomware incident on December 8, 2025. Officials described it as an attempted infiltration that led to an immediate response.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetherecord.media
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cookeville Regional Medical Center in Tennessee disclosed that a ransomware attack tied to the **Rhysida** gang exposed the personal, financial, and protected health information of **337,917 individuals**. The hospital said an unauthorized party accessed its network between **July 11 and July 14, 2025**, and a forensic investigation later determined that files may have been viewed or stolen during that period. Exposed data varied by individual and could include names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial account details, medical information, medical record numbers, and health insurance information. Rhysida claimed responsibility for the intrusion, saying it exfiltrated about **538 GB** of data and later listed the medical center on its dark web leak site, where it said **70%** of the data had been leaked. The breach was initially reported to HHS with a placeholder figure before a full file review was completed in March 2026, after which the hospital began broader notifications. Cookeville Regional said it has not found evidence of misuse so far, urged affected people to monitor accounts and explanation-of-benefits statements, and offered **12 months** of credit monitoring and identity theft protection.
Jun 29, 2026
The **Rhysida** ransomware operation has intensified its focus on healthcare, with reporting and government guidance describing an expanding threat that has hit organizations across Western Europe, the Americas, and Australia. U.S. health-sector alerts and vendor research say the group has targeted education, government, manufacturing, technology, managed service providers, and increasingly **healthcare and public health** entities. Researchers have also linked Rhysida to tactics associated with the defunct **Vice Society** operation, while earlier incidents included the leak of stolen documents from the Chilean Army and suspected involvement in disruptive attacks on medical providers. Security reporting says Rhysida commonly gains initial access through **phishing** and then uses tools such as **Cobalt Strike** and **PowerShell** to disable defenses, delete shadow copies, alter RDP settings, and deploy ransomware. In a newly reported healthcare case, **SIA Medical Centre** was listed as a victim, with the attackers claiming theft of roughly **20,000 patient medical records** along with staff identity documents, plaintext credentials, HR files, and legal and financial records. The allegedly exposed data included names, dates of birth, Medicare numbers, clinical notes, insurance files, passports, driver’s licenses, and login credentials, underscoring the group’s dual risk of operational disruption and large-scale sensitive data exposure in the health sector.
Aug 15, 2026
The British Library suffered a major ransomware attack attributed to **Rhysida** that knocked out its website, online catalogue, digital collections, email, phone network, public Wi‑Fi, and parts of its onsite operations in London and Yorkshire. The disruption forced staff to fall back on limited manual processes for reader services, item ordering, and payments, while the library kept its sites open with reduced functionality. The library said it worked with the UK **National Cyber Security Centre**, law enforcement, private forensic specialists, and the Metropolitan Police as it investigated and contained the incident. Rhysida claimed responsibility, leaked internal HR documents, and attempted to auction stolen data for **20 bitcoin** before publishing about **573GB** of files, including data reportedly taken from CRM systems. The library later said stolen information included personal data such as names, email addresses, and in some cases postal addresses and phone numbers, though not apparently financial data. Recovery took months: by mid-January the library had begun restoring its online catalogue, but warned that broader remediation could take many more months and carry multimillion-pound costs. The outage also disrupted the UK **Public Lending Right** scheme, delaying royalty payments to more than 20,000 authors and other contributors.
Jun 29, 2026