Cyberattack Devastates Cherokees in North Carolina

The Eastern Band of Cherokee Indians in North Carolina, who own and operate Harrah’s Cherokee (l.). fell victim to a hacker and a ransom. The tribe turned to Microsoft to rebuild their system into an advanced product.

Cyberattack Devastates Cherokees in North Carolina

It can’t hurt to have one of the most tech-advanced IT systems in the country. The Eastern Band of Cherokee Indians (EBCI), whose lands lie in the westernmost portion of North Carolina, are moving in that direction after a Russian hacked their existing system and changed the data on almost every piece of equipment.

Worse, the hack may have led to the death of a local resident whose car smashed into a tree in the middle of the night. Because the system was knocked out, paramedics could not locate the victim. By the time they reached her, she had passed.

“Would that person have survived (without the delay)? Perhaps. We don’t know,” said Richard Sneed, principal chief of the EBCI. “But the reality is, when there’s an emergency, every minute counts.”

A former employee was arrested and spent more than a year in jail.

EBCI leaders invited Microsoft cloud solutions architect Elliot Huffman to work onsite at tribal headquarters to clean up and update their system. He arrived in March 2020.

“An absolutely beautiful place,” Huffman says. “It’s a bustling community with small shops and the best views.”

Still, months of work lay ahead.

“When I got there,” Huffman recalls, “they were basically screaming for help: ‘We lost everything.’”

The hacker had encrypted every computer with a different key. Those keys were sent back to a command-and-control structure managed by the hacker’s counterparts in Russia.

Their immediate priorities: revive both 911 dispatch and the tribe’s financial system. Twice each year, every EBCI member receives a disbursement of several thousand dollars, an amount based on revenues from two tribally owned casinos. The cyberattack had delayed those per-capita payments.

“At first, I was mad. But then I was like, ‘Hey, this is good.’ I was trying to log in from another country and it would not let me access the network, period. I understood the reason why,” Sneed says.

“This crisis laid bare all the areas we thought were secure, all the shortcomings. Many people probably thought, just like I had, that it would never happen to us.”