Turning Stone Goes Cash-Only After Cybersecurity Incident

Turning Stone Enterprises, the business arm of the Oneida Indian Nation in central New York, reported a cybersecurity incident on Monday, November 2, 2026, and took selected internal systems offline as a precaution. By Tuesday, November 3, the company's gaming properties were operating on a cash-only basis, according to reporting by Casino.org, which cited local coverage from WKTV and WSYR. The Turning Stone cybersecurity incident is ongoing, and the company has not said when normal operations will resume.

This article sets out what has been publicly reported, what remains unknown, and how the episode fits into the broader operational risks facing tribal gaming enterprises. It will be updated in later coverage if the company or the Nation releases new information.

What has been reported

The properties named in the reporting are Turning Stone Resort Casino in Verona, Point Place Casino in Bridgeport, and YBR Casino & Sports Book in Chittenango. Hospitality and retail locations tied to the enterprise, including The Lake House at Sylvan Beach, Maple Leaf Markets and SavOn convenience stores, were also reported to be restricted to cash for a time.

The practical effects reached well beyond the gaming floor. Credit cards could not be used. ATMs, sports betting and bingo were reported unavailable, and the TS Rewards loyalty program was disrupted. For a resort that draws regional visitors across several business lines, losing card acceptance and rewards tracking at the same time removes much of the machinery that normally connects a guest's spending to the property's revenue records.

The company has said the shutdowns were intended to protect guests' personal information while cybersecurity specialists investigate. Local reporting says the company has found no evidence that confidential information was accessed, and that the investigation continues. In a statement posted to Facebook, it said it was working "at full speed with cybersecurity experts to return to full working order," and it has said management will publish evening updates on service availability until systems are fully restored.

What is not known

As of this writing the cause has not been publicly identified. The company has not said whether an outside party was responsible, whether ransomware was involved, or what systems were affected beyond those described above. No timeline for restoration has been given, and the reporting does not name company executives or Nation officials. Readers should treat any claims about the attacker, a ransom demand or data exposure as unconfirmed unless the Nation or Turning Stone states them directly.

The distinction matters. A precautionary shutdown, in which operators deliberately disconnect systems to contain a problem, is operationally different from an attack that has already encrypted or exfiltrated data. Operators often take the first step so they do not have to face the second. The public statements so far describe the first.

Why tribal casinos face particular exposure

Casino.org's account notes that the FBI has said tribal casinos may be attractive targets because attackers perceive their defenses as weaker. That is a general assessment rather than a finding about any single operator, and large enterprises such as Turning Stone typically carry significant security investment. But the structure of a modern casino resort concentrates risk. Slot systems, player accounts, hotel property management, food and beverage point-of-sale, surveillance and payment processing all connect to one another, and an incident in one layer can force operators to disconnect the rest.

The scale of the commercial consequences is well documented elsewhere in the industry. The September 2023 cyberattack on MGM Resorts was estimated by the company to reduce third-quarter earnings by roughly $100 million. Tribal operators are generally smaller than MGM, but their revenue is also more tightly bound to government services: gaming proceeds fund tribal programs, so an extended outage is felt in budgets as well as on a profit-and-loss statement. For background on how those revenues are allocated, see our explainer on IGRA's five permitted uses of net gaming revenue.

Earlier tribal incidents show the range of outcomes. In February 2025, the Sault Tribe of Chippewa Indians in Michigan was hit by a ransomware attack that disrupted computer and phone systems, including health and casino operations, and services returned gradually over the following weeks. Our earlier coverage of tribal casino cybersecurity and ransomware and of business continuity planning at tribal casinos examines how operators prepare for these events.

Context: a major regional operator

Turning Stone is among the best-known tribal resorts in the Northeast and has been in a phase of heavy reinvestment. Readers following the property can review our reports on the $370 million Crescent hotel expansion and the broader tribal casino directory. The incident arrives while the resort's expanded hotel capacity is a central part of its business, which makes guest-facing systems such as reservations and rewards especially important to restore.

For New York's wider market, including the state's other tribal operators and the compact questions facing the Seneca Nation, see our New York market deep dive.

What to watch next

Three developments will clarify the picture. The first is the company's daily service updates, which will show how quickly card acceptance, sports betting and bingo return. The second is any statement about whether personal or financial information was affected, which could trigger notification obligations under state law and, for tribal operators, under the Nation's own regulations. The third is whether the company or the Nation identifies the cause. Tribal gaming commissions and the National Indian Gaming Commission both have roles in oversight of gaming operations, and our legal guide explains how that regulatory structure works.

Until more is disclosed, the reasonable reading is limited: a major tribal gaming enterprise detected a problem, chose to disconnect systems, and is operating on cash while specialists work. Guests planning visits should rely on the company's official channels for current service status.