Ransomware Attack Disrupts Three Affiliated Tribes’ Operations in North Dakota On April 28, the Three Affiliated Tribes the Mandan, Hidatsa, and Arikara (MHA) Nation confirmed a ransomware attack on its servers, crippling access to critical files, email, and internal systems. Tribal leadership, including Chairman Mark Fox and CEO Scott Satermo, notified employees that the incident had disrupted operations, with the malware altering file locations and names. A cybersecurity team was deployed on-site to begin system recovery, and employees were instructed to avoid using work computers until further notice. Ransomware, a form of malware that encrypts or threatens to leak data unless a ransom is paid, has surged in frequency, with the FBI reporting an attack every 40 seconds. The MHA Nation’s breach aligns with a broader trend of escalating cyber threats targeting government entities, including tribal nations. According to the National Association of State Chief Information Officers (NASCIO), 68% of state-level breaches in 2020 stemmed from malicious code, while 86% were linked to hacktivism. Tribal governments remain particularly vulnerable, with limited public data on the scope of such attacks. The Cybersecurity & Infrastructure Security Agency (CISA) notes that ransomware actors increasingly exploit exfiltrated data as leverage. In 2019, the Eastern Band of Cherokee Indians faced a similar incident, which led to the arrest of a tribal employee on charges of tampering with public records. The MHA Nation’s attack occurs amid heightened federal attention on tribal cybersecurity. Congress is considering the State and Local Cybersecurity Improvement Act, which would allocate $25 million to tribal governments through CISA, though the bill remains stalled in the Senate. The COVID-19 pandemic has further amplified cyber risks as remote work and digital operations expand. The Department of Homeland Security has not released additional details, directing inquiries to the tribe for further information. The incident underscores the growing threat of ransomware to tribal and local governments, with recovery efforts ongoing.