State of Nevada

Summary

The state of Nevada suffered a ransomware attack that disrupted operations across approximately sixty government offices, leading to a recovery effort that lasted several weeks and required more than four thousand two hundred hours of overtime work from technology staff while refusing to pay the attackers. Following the incident, the state released a detailed after‑action report and subsequently introduced a statewide data classification policy that defines four sensitivity levels—public, sensitive, confidential, and restricted—to standardize how agencies handle and protect information, assigning responsibility for compliance to agency leaders and lower‑level data officials.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In July 2025 Nevada established the Office of Information Security and Cyber Defense as a new division within the Governor’s Technology Office to support state cyber strategy and to build a statewide Security Operations Center that local governments could opt into at no cost. The office was intended to give local governments the ability to opt in to the SOC’s services without charge, extending state protections beyond the governor’s office. Approximately one month later, in August 2025, the state experienced a ransomware attack that affected systems at roughly sixty state offices. The attack occurred shortly after the new cyber defense office had been created, testing the nascent capabilities of the organization.

The recovery effort lasted nearly a month and involved multiple technology partnerships while state staff logged more than four thousand two hundred hours of overtime. Throughout the incident Nevada did not pay a ransom to the threat actor. The state’s response was described as transparent and deliberate, culminating in the publication of a public after action report. This after action report has been cited as a useful resource for other states seeking to improve their own cyber strategies.

Months after the attack, in February 2026, Nevada’s Governor’s Technology Office announced a new statewide data classification policy that created four categories: public, sensitive, confidential, and restricted. Under the policy agencies must determine the appropriate classification for their data, placing uncertain data in the more restrictive category, and agency leaders are responsible for ensuring compliance while lower‑level data officials make the classification decisions. The policy defines public data as having no restrictions, sensitive data as internal correspondence not for proactive distribution, confidential data as including personally identifiable information and health records that could cause substantial harm if disclosed, and restricted data as information limited to personnel with specific clearances where unauthorized disclosure could threaten public safety or violate federal security rules. The state said the policy would serve as a foundation for future cybersecurity improvements such as multifactor authentication and would strengthen overall digital resilience while enabling responsible data sharing across agencies.

Sources

Sources available to members: 2 sources.