Two Kings Casino: Hackers Claim Theft of $700 Million NC Resort’s Blueprints

• Hackers Threaten to release plans for $700M casino
• Tribe says stolen documents are outdated drafts
• Anubis latest in wave of ransomware groups targeting tribal casinos

A ransomware group calling itself “Anubis” claims to have stolen comprehensive blueprints for the Two Kings Casino in Kings Mountain NC. The group is threatening to release the documents unless the tribe pays a ransom.

Beyond the extortion threat, there’s no indication of any disruption to casino services or that private customer data has been compromised, the tribe said.

The tribe is currently operating a temporary gaming venue while it builds a $700 million resort scheduled to open in 2026. It’s this new facility that is being targeted by the hackers.

Dark Web Threat

Anubis made the announcement on the Dark Web Wednesday, warning the tribe it had 19 hours to pay up. That deadline has now passed, and the current situation is unclear.

Trent Troxel, vice president of the Catawba Nation Gaming Authority, claimed in a statement that the blueprints in question were outdated drafts depicting previous design and construction plans.

Although our investigation is ongoing, there is no indication that our network, operations, or customer data have been impacted or that this information was obtained via the Catawba Two Kings Casino network,” said Troxel. “We take the security of customer data very seriously and will continue to diligently investigate.”

As of Thursday, the tribe said it isn’t aware that any documents had been leaked by the hackers, Troxel added.

Potentially Damaging

The hackers claim to have comprehensive architectural plans, including layouts of the main gaming floor, hotel tower, parking areas, and restricted zones like vaults, server rooms, surveillance camera placements, and staff areas.

Real leaked blueprints could be very damaging for a project such as this one, potentially shaking the trust of stakeholders and financial backers while inviting regulatory scrutiny, of which the Catawba has already had its fair share.

Who is Anubis?

Anubis appears to be a relatively new ransomware group, first appearing in or around Q4 of 2024. The group has previously targeted healthcare companies in Australia and Canada, and construction companies in Peru and the US.

Cyberattacks against the Lower Sioux Indian Community’s Jackpot Junction Casino in Minnesota and the Sault Ste. Marie Tribe of Chippewa Indians’ Kewadin Casinos in Michigan, respectively, have caused massive disruption to operations.

In a bizarre twist, Ransomhub wrote a letter to the Sault Tribe’s local newspaper The Sault Tribe Guardian to chastise the tribe’s leadership for its refusal to play ball.