Loading story…
A ransomware attack on the Nevada state government was enabled by a state employee's accidental download of a trojanized system administration tool from a fraudulent website in May. The attackers established a backdoor, conducted lateral movement, and infiltrated the state's password vault server over several months. By August, they had exfiltrated sensitive data, deleted backup volumes, and deployed ransomware, disrupting services at more than 60 state agencies, including health benefits, public safety records, and DMV operations. The incident forced critical systems offline for up to 28 days, with recovery efforts requiring a full rebuild of Active Directory and significant overtime from IT staff. The state did not pay a ransom, and most recovery costs were covered by cyberinsurance, totaling at least $1.5 million.
The after-action report from Nevada's technology office highlighted the attacker's use of search ads to distribute malware disguised as legitimate admin tools, a growing trend in initial access techniques. Despite the extensive impact, Nevada was commended for its accelerated response and transparency in reporting, restoring 90% of impacted data within a month. The incident underscores the risks of supply chain and user-driven compromises, as well as the importance of robust detection, backup, and identity management practices in defending against sophisticated ransomware campaigns targeting government infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Multiple outlets reported that the Nevada incident stemmed from a breach dating back to May 2025, with attackers evading detection until the ransomware attack was uncovered. These reports added technical and timeline detail to the public understanding of the case.
Following the ransomware attack, Nevada chose not to pay the attackers' ransom demand. This decision was highlighted in subsequent reporting on the state's response to the incident.
Nevada officials discovered that government systems had been encrypted in a ransomware attack after attackers had already been inside the environment for months. The discovery marked the public emergence of the incident.
After the initial breach, the threat actors reportedly maintained access inside Nevada government systems for several months without being detected. Later reporting characterized this dwell time as a key factor in the eventual ransomware impact.
Reporting says the cyberattack against the State of Nevada was traced back to an initial compromise in May 2025, indicating attackers had access months before the incident was discovered. The intrusion reportedly went undetected for an extended period.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityboulevard.com
Open sourcescworld.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nevada said a statewide ransomware attack that disrupted multiple government services began when a state employee installed a malware-laced system administration tool, giving attackers an initial foothold on May 14 before the intrusion was discovered on Aug. 24. Investigators found the attackers used remote monitoring software, an encrypted tunnel, and compromised credentials to move laterally, access more than 26,000 files, and pull passwords from 26 accounts, including a password vault server. State officials later confirmed data was stolen, though the final incident report said more than 3,200 files were exposed and found no evidence that packaged sensitive data was successfully exfiltrated or published; only one document queued for removal contained personal data, and the affected individual was notified. Nevada restored operations within 28 days and said it did not pay the ransom. The response cost the state about **$1.5 million**, including more than **$1.3 million** for outside vendors and over **$200,000** in employee overtime, with Mandiant leading the investigation and recovery efforts. Officials prioritized payroll, public welfare systems, and phased restoration of critical services, then launched follow-on security projects and a new statewide data-classification policy aimed at tightening monitoring, detection, and incident response. The post-incident review concluded that the recovery was successful but underscored gaps in continuous visibility and defensive controls across Nevada's environment.
Jun 29, 2026
Nevada officials said a **major ransomware attack** prompted the state to accelerate cybersecurity and digital modernization efforts, with State CIO **Tim Galluzi** framing the incident as proof that resilience, workforce readiness, and governance must be built into daily operations rather than treated as one-time projects. The state subsequently secured unanimous legislative support and backing from the governor to invest in new cybersecurity tools and infrastructure intended to better protect resident data and critical government systems. Nevada's response emphasizes **zero trust architecture**, stronger **identity and access management**, and broader cross-agency coordination as part of a longer-term modernization strategy. Galluzi described identity as the "new firewall" in an environment where employees, partners, and residents increasingly access systems remotely, and he also highlighted workforce training as a core defensive measure alongside technology upgrades and improved service delivery.
Jun 29, 2026
Rome’s **La Sapienza University** shut down network systems as a precaution after a cyberattack caused widespread disruption and left its website offline; Italian media attributed the incident to a suspected ransomware operation linked to pro-Russian actor **Femwar02**, with reported tradecraft resembling **Bablock/Rorschach**-style fast encryption. Separately, Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT and took down `www.conpet.ro` while leaving **OT/SCADA** and pipeline transport operations unaffected; **Qilin** claimed responsibility, alleging theft of nearly **1TB** of data and posting sample documents (including financial data and passport scans) to support extortion claims. In the U.S., government services contractor **Conduent** faced expanding breach impact from its January 2025 ransomware incident, with notifications indicating exposure potentially reaching **dozens of millions**; reported affected data includes **names, Social Security numbers, and medical/health insurance information**, with at least **15.4M** impacted in Texas and **10.5M** in Oregon per state disclosures. Additional healthcare-sector disclosures included a ransomware-linked intrusion at **Insightin Health** (unauthorized access in September 2025; **Medusa** claimed exfiltration of **378GB**) and a separate compromise at **Clinic Service Corporation** (August 2025 access window), while **Central Ozarks Medical Center** reported a criminal cyberattack affecting **11,818** individuals with exposure of PHI/PII (including SSNs and financial/insurance data). Other items in the set were not incident-specific: an **HHS-OIG** audit describing web application security weaknesses at a large hospital, and general guidance/education pieces on the value of medical records to attackers and **CISA** insider-threat guidance.
Jun 29, 2026