Cybersafetyconnections November 10, 2025 vol#243 

  • It was reported that a ransomware attack against the state of Nevada, which began in May 2025, was finally resolved and made public in November 2025. 
  • The attack happened as a result of an employee downloading a malware tool. 
  • No cybercriminal claimed responsibility for the attack. 
  • Here is how the state of Nevada mitigated loss from the cyberattack. 

What happened? 

Splunk Security to defend Against 

As reported by tahoedailytribune.com the ransomware attack began when a state employee downloaded a malware tool on May 14, 2025, that lead to a back door being created in the state system. Though the malware was deleted in the month of June 2025, by Symantec Endpoint Protection, that back door remained open. 

By august 4th the attacker then installed a monitoring software on the compromised employee’s system to record screens and keystrokes.10 days later another employee got compromised making two of them. 

Eight days before the attack, the attacker used a device to bypass security controls to control the the state computer system. The attacker was then able to gain access to directories, files and servers — including a password vault server — and got passwords from 26 different accounts. 

Before the ransomware attack on August 24th, 2025, the attacker changed the state security setting, deleted back up volumes which allowed them to run unauthorized code which disrupted the state system. 

The attacker left instructions on how to pay ransom. 

Who was impacted? 

According to cybersecuritydive.com the attack impacted more than 60 agencies across the Nevada government, which included critical services at the Department of Health and Human Services, the Department of Motor Vehicles and the Department of Public Safety.  

Department of Motor Vehicles, sex offender and restraining order databases and the state’s background check system were impacted the most. 

The attacker whose identity was not revealed, gained access to more than 26,400 files and another 3,200 files were left exposed across many systems. 

Why did the attack happen? 

Malware Detected Warning 

Already from the reports above, the ransomware attack happened because an employee downloaded a malware tool. 

Which cybercriminal took responsibility for the cyberattack? 

Security Alarm Cyberattack Warning 

No cybercriminal claimed responsibility for the cyberattack although the attacker was mentioned in the reports. 

How did the state of Nevada mitigate loss from the cyberattack? 

Pre and Post Diseaster Management 

The state refused to pay ransom demand and recovered 90 percent of the data after 28 days because it had cybersecurity insurance and had negotiated agreements with vendors. 

Mynew4.com reported that the recovery effort to rebuild systems, and restore statewide services in less than a month. 

In large part, the action of the executive office and investment in cybersecurity and disaster recovery and resilience planning were responsible to the successful recovery. 

On its own part, the governor’s office gave credit for the quick turnaround to disciplined planning, strong partnerships, and dedicated public employees. 

It was reported that the state spent about $1.3 million in expenses in regard to recovery costs, as several major companies were brought on to help investigate and restore agency services, including Mandiant, Dell, Microsoft DART, Palo Alto Networks, Aeris, and other firms.   

  • From tahoedailytribune.com on the day of the response, the state officers compiled a list of what was priority in terms of recovery effort. 
  • By the next day, work began with outsider vendors who had cybersecurity experience. 
  • Day 2 of the attack, the state brought a leading cybersecurity firm Mandiant, to oversee the investigation. The work was concluded in two weeks and Mandiant submitted their report on October 10. 
  • On day 4, the state finalized its recovery plan, which would be a phased recovery with priority given to services that directly impact public welfare. Employee payroll was a top priority for the governor’s office, so state employees now set it aside as a priority item. 
  • Other priority areas were the state’s finance and HR systems, the restoration of an Office of Emergency Management webpage that became the one-stop shop for recovery updates, and restoring eligibility determinations for social services, such as the food stamps program. 
  • From Aug. 24 through Sept. 20, it was reported that 50 state employees logged overtime hours on recovery efforts, which was said to have been responsible for the speedy recovery efforts. 
  • The governor’s technology office made sure only access to sensitive information was given to essential employees and also cleaned up old accounts and reset password. 
  • The governor’s technology office organized computers system into level of importance and made rules about what can and cannot be done in the system. 

In addition, the governor’s office also: 

  • Made changes to ensure certain accounts couldn’t be tricked into giving away passwords. 
  • Took certain powers away from accounts that had too much control. 
  • Took away extra permissions that certain accounts had received. 
  • Tightened firewall rules to limit or block unnecessary applications. 

Copilot on its part provides steps to mitigate loss. 

The Nevada ransomware attack (August 2025) was traced to an employee downloading malware from a spoofed site. The state mitigated losses by refusing to pay ransom, recovering 90% of data, and relying on insurance and vendor agreements Cybersecurity Dive StateScoop Cybersecurity Insiders. 

🛡️ Key Mitigation Actions Taken by Nevada 

  • Refused to Pay Ransom  
  • Data Recovery & Backups  
  • Insurance & Vendor Agreements  
  • Pre-negotiated contracts and cyber insurance helped cover costs and accelerate recovery Cybersecurity Dive. 
  • Incident Response Planning  
  • The Governor’s Technology Office had funded cybersecurity initiatives and resilience planning, which contained the attack EITS KTNV 13 Action News. 
  • Forensic Investigation  
  • Identified root cause: a malware-laced system administration tool downloaded by an employee from a spoofed website StateScoop. 
  • Communication & Continuity  
  • Core services (payroll, essential operations) were maintained during recovery KTNV 13 Action News. 

🔧 Broader Lessons for Mitigating Loss 

To reduce impact from similar ransomware incidents, organizations should adopt a layered strategy: 

  • Preventive Controls 
  • Employee security awareness training (spotting spoofed sites, phishing). 
  • Application whitelisting and restricted admin rights. 
  • Endpoint detection and response (EDR) tools to flag malicious downloads. 
  • Resilience & Recovery 
  • Regular, tested backups stored offline or immutable. 
  • Pre-negotiated vendor contracts for rapid forensic and recovery support. 
  • Cyber insurance coverage tailored to ransomware scenarios. 
  • Detection & Response 
  • Continuous monitoring with SIEM/SOAR platforms. 
  • Threat hunting to detect long-dwell intrusions (Nevada’s breach began months before detection). 
  • Incident response playbooks with clear escalation paths. 
  • Governance & Risk Management 
  • Funding cybersecurity initiatives proactively (Nevada’s foresight helped contain the attack). 
  • Regular tabletop exercises to test readiness. 
  • Clear communication strategies to maintain public trust. 

📌 Takeaway 

Nevada’s case shows that refusing ransom, having backups, and pre-planning with insurance and vendor agreements can drastically reduce losses. The real lesson is that employee mistakes are inevitable, so resilience planning and rapid recovery capabilities are what ultimately protect organizations. 

Subscribe for the latest blog post.