Over the weekend, RansomHub added two US government entities to its data leak site — the City of Tarrant and Sault Ste. Marie Tribe of Chippewa Indians. In the case of Tarrant, it alleges to have stolen 28 GB of data, while a purported 119 GB has been stolen from the Sault Tribe. Both of these government organizations confirmed ransomware attacks earlier this month.
Sault Ste. Marie Tribe of Chippewa Indians was first hit on Sunday, February 9. The attack severely impacting a number of services, including its casinos and health division. In an update at the end of last week, the tribe thought it would be operating in limited capacity for another week.
The tribe hasn’t confirmed whether or not a ransom was demanded/paid, but RansomHub’s upload claims: “We waited an entire week for Sault Tribe of Chippewa Indians to engage in negotiations, but no communication was initiated.” It is giving the tribe until Wednesday to meet its demand or the stolen data will be published. This data is said to include the personal data of residents, customers, and employees across various systems, including Kewadin casinos, Sault Tribe health centers, government buildings, convenience stores, community centers, and the transit center.
In the City of Tarrant, Alabama, systems were taken offline on Monday, February 10. The attack originated in the police department’s systems, which coincides with RansomHub’s proof pack. It contains a police incident report, a crime victim’s compensation form, an officer’s monthly report, and a traffic crash report.
The city did confirm it wouldn’t meet the hacker’s demands and that it would continue operating as normal. Systems were taken offline, however, which meant police had to resort to pen and paper.
Neither entity has confirmed RansomHub’s claims. We have contacted them for further information, including how much ransom was potentially demanded, how RansomHub allegedly accessed systems, and how many people could be affected by a subsequent data breach. We will update this article with any responses.
Who is RansomHub?
RansomHub continues its onslaught of attacks this year following a prolific end to 2024–it racked up a total of 539 victims in 2024, 105 of which are confirmed. So far this year, it’s added 90, six of which are confirmed.
Other recent victims of RansomHub are the South African Weather Service and Transcend Information, Inc. (Taiwan). Both also confirmed attacks this month.
Government organizations are a popular target for the gang with 26 confirmed attacks on this sector and a further nine unconfirmed (across 2024 and 2025). Its average ransom demand on government organizations is $2.79 million.
RansomHub is a ransomware-as-a-service variant thought to have ties to Russia. It often follows a double-extortion technique, demanding a ransom for a decryption key to unlock the company’s systems and another for deleting all of the stolen data.
Ransomware attacks on US government organizations
Four government entities have confirmed ransomware attacks this year so far. Laramie County Library System and the City of West Haven suffered attacks in January. Akria targeted Laramie while Qilin was responsible for the attack on West Haven. 4,932 people were caught up in the subsequent breach on West Haven.
Throughout 2024 we also noted 87 attacks on US government entities, affecting nearly 1.6 million records in total. These figures were an increase on those witnessed in 2023 (83 attacks affecting just over 913,000 records). From 2023 to 2025, the average ransom on US government departments was $1.79 million.
In 2024 we also noted 30 unconfirmed attacks and have seen eight so far this year.
About Sault Ste. Marie Tribe of Chippewa Indians
The Sault Tribe has a community population of 44,000 and spans the Michigan counties of Alger, Chippewa, Delta, Luce, Mackinac, Marquette, and Schoolcraft. The tribe is comprised of casinos, housing and tribal centers, and other enterprises.
About the City of Tarrant
Located in Jefferson County, the City of Tarrant, Alabama, borders Birmingham and is home to over 6,000 people.
