Cyber Heist Disables Slot Machines at Minnesota’s Jackpot Junction Casino

Summary

• Cyber incident disrupts: A ransomware attack forced Jackpot Junction Casino Hotel in Minnesota to shut down its slot machines.
• Impacts on operations: The Lower Sioux Indian Community, which owns the casino, also lost phones and email at its government offices and health center.
• Investigation underway: The tribe took systems offline and brought in outside experts.
• Return to normalcy: Work is focused on restoring systems safely and tightening security.

Cyber Heist Disables Slot Machines at Minnesota’s Jackpot Junction Casino

Introduction: Slots Go Silent

Jackpot Junction Casino Hotel in Morton, in southwest Minnesota, went quiet in late March 2025 when a cyberattack hit its systems. Phones stopped working first. Then the slot machines and kiosks went dark, bingo was canceled and the hotel could not book or change reservations. The casino is owned by the Lower Sioux Indian Community, and the attack spread well beyond gaming.

Impact and Immediate Response

The disruption was wide. Tribal government phones and email went down, government offices closed early and the community health center and pharmacy had to set up temporary phone lines. Table games and bars stayed open, but most of the casino’s revenue comes from slots. Lower Sioux council president Robert Larsen confirmed that an unauthorized party had accessed certain systems, and the tribe said it had activated its incident response plan and taken systems offline to contain the attack.

Who Was Behind It

The RansomHub ransomware group claimed responsibility on its leak site. It was one of the most active gangs of the time and had hit another tribal nation, the Sault Ste. Marie Tribe of Chippewa Indians, earlier in 2025. The tribe has not said whether it paid a ransom or whether personal data was stolen.

What It Means for Casinos

Casinos are attractive targets. They hold guest identity and payment data, and every hour offline costs real money, which raises the pressure to pay. Tribal casinos have been hit repeatedly in recent years, and many run on small IT teams. The case is a strong argument for segmenting gaming systems from office networks and for keeping offline backups.

Recovery

The tribe worked with outside specialists to restore systems. Guests were told the casino was working to return to normal operations as quickly and as securely as possible, and the community said it would review its security practices.

The Lesson

The attack on Jackpot Junction is another reminder of how one intrusion can spread across an organization. Here it reached a casino and a tribal government. It also hit a health clinic. Small organizations with shared networks are especially exposed. For casinos and tribal governments alike, the basics apply: multi-factor authentication, patched remote-access systems, separated networks and backups that attackers cannot reach.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.