Loading story…
Nevada officials said a major ransomware attack prompted the state to accelerate cybersecurity and digital modernization efforts, with State CIO Tim Galluzi framing the incident as proof that resilience, workforce readiness, and governance must be built into daily operations rather than treated as one-time projects. The state subsequently secured unanimous legislative support and backing from the governor to invest in new cybersecurity tools and infrastructure intended to better protect resident data and critical government systems.
Nevada's response emphasizes zero trust architecture, stronger identity and access management, and broader cross-agency coordination as part of a longer-term modernization strategy. Galluzi described identity as the "new firewall" in an environment where employees, partners, and residents increasingly access systems remotely, and he also highlighted workforce training as a core defensive measure alongside technology upgrades and improved service delivery.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Nevada named retired Army lieutenant colonel Bertrum Carroll as its new chief information security officer following the statewide ransomware incident. Carroll said he would begin by assessing the state's top risks and focus on governance, workforce training, vendor expectations and responsible AI-era data use.
As part of its broader modernization push, Nevada began exploring artificial intelligence to enhance resident-facing digital services while pursuing secure innovation across agencies.
State leaders moved to accelerate digital modernization by emphasizing zero trust architecture, identity and access management, and workforce training to improve defenses against phishing and social engineering.
Following the attack, Nevada obtained unanimous legislative support and backing from the governor to fund new cybersecurity tools and technology infrastructure to better protect resident data and critical systems.
Nevada experienced a major statewide ransomware attack that exposed the need for stronger resilience, governance and day-to-day cybersecurity preparedness across state operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
statescoop.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nevada said a statewide ransomware attack that disrupted multiple government services began when a state employee installed a malware-laced system administration tool, giving attackers an initial foothold on May 14 before the intrusion was discovered on Aug. 24. Investigators found the attackers used remote monitoring software, an encrypted tunnel, and compromised credentials to move laterally, access more than 26,000 files, and pull passwords from 26 accounts, including a password vault server. State officials later confirmed data was stolen, though the final incident report said more than 3,200 files were exposed and found no evidence that packaged sensitive data was successfully exfiltrated or published; only one document queued for removal contained personal data, and the affected individual was notified. Nevada restored operations within 28 days and said it did not pay the ransom. The response cost the state about **$1.5 million**, including more than **$1.3 million** for outside vendors and over **$200,000** in employee overtime, with Mandiant leading the investigation and recovery efforts. Officials prioritized payroll, public welfare systems, and phased restoration of critical services, then launched follow-on security projects and a new statewide data-classification policy aimed at tightening monitoring, detection, and incident response. The post-incident review concluded that the recovery was successful but underscored gaps in continuous visibility and defensive controls across Nevada's environment.
Jun 29, 2026
Nevada’s Governor’s Technology Office introduced a **statewide data classification policy** intended to standardize how state agencies label and protect information following a **major cyberattack** that disrupted government systems for weeks. The framework establishes four sensitivity tiers—**public**, **sensitive**, **confidential**, and **restricted**—and directs agencies to choose the more restrictive category when classification is unclear, aiming to prevent inconsistent handling of private versus public data and to create a common baseline for interagency data sharing. State officials and lawmakers described the policy as a foundational step for broader cybersecurity improvements in the wake of the incident, alongside initiatives such as expanding **multifactor authentication**, standing up a new **Security Operations Center (SOC)**, and forming a legislative working group to guide future security measures. The policy is positioned as a standardization and resilience measure and does **not** change Nevada’s public records law, under which records are presumed public unless specific confidentiality provisions apply.
Jun 29, 2026
A ransomware attack on the Nevada state government was enabled by a state employee's accidental download of a trojanized system administration tool from a fraudulent website in May. The attackers established a backdoor, conducted lateral movement, and infiltrated the state's password vault server over several months. By August, they had exfiltrated sensitive data, deleted backup volumes, and deployed ransomware, disrupting services at more than 60 state agencies, including health benefits, public safety records, and DMV operations. The incident forced critical systems offline for up to 28 days, with recovery efforts requiring a full rebuild of Active Directory and significant overtime from IT staff. The state did not pay a ransom, and most recovery costs were covered by cyberinsurance, totaling at least $1.5 million. The after-action report from Nevada's technology office highlighted the attacker's use of search ads to distribute malware disguised as legitimate admin tools, a growing trend in initial access techniques. Despite the extensive impact, Nevada was commended for its accelerated response and transparency in reporting, restoring 90% of impacted data within a month. The incident underscores the risks of supply chain and user-driven compromises, as well as the importance of robust detection, backup, and identity management practices in defending against sophisticated ransomware campaigns targeting government infrastructure.
Jun 29, 2026