State of Nevada
Nevada statewide ransomware disruption
Summary
Ransomware disrupted Nevada government systems and public services in August 2025 after an intrusion traced to May. The state reported full service restoration within four weeks without paying a ransom, while residual data recovery and review remained separate issues.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Malware
Malicious software other than ransomware used to compromise or disrupt systems.
-
Credential compromise
Theft, exposure, or abuse of user or administrator credentials.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data encryption
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
-
Data deletion or destruction
Data was intentionally deleted, wiped, destroyed, or made permanently unrecoverable.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
-
Backup compromise
Backup data or backup systems were accessed, encrypted, deleted, altered, disabled, or otherwise compromised.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Website unavailable
A public-facing website was unavailable, disabled, or inaccessible.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Facility closure
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
Extortion indicators
-
Ransom demand
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
-
Encryption-based extortion
The extortion activity involved unauthorized encryption of systems or data, with restoration or decryption conditioned on payment.
-
Payment denied
An authoritative source stated that no ransom or extortion payment was made.
Incident narrative
Analyst assessment
Nevada’s state government experienced a ransomware attack that disrupted shared systems and public services beginning Aug. 24, 2025. We reported the initial office closures Aug. 25.
The state’s after-action report traces initial compromise to May 14, when an employee downloaded a malicious administration tool from a spoofed website reached through advertising. A backdoor persisted after the tool was quarantined. Attackers later compromised credentials, deleted backup volumes and encrypted virtual machines.
Operational significance
The initial official notice suspended in-person state services and warned of intermittent websites, online services and office phones. Statewide 911 call-taking remained available. Closure of service counters did not mean that every emergency or benefit function stopped.
Recovery occurred in stages. On Sept. 2, DMV offices offered vehicle transactions and testing, but driver-license and ID-card transactions remained unavailable. The agency accepted canceled vehicle appointments as walk-ins and waived related late fees.
The Brady background-check system resumed Sept. 14, with telephone support restored and potential processing delays during stabilization. Statewide restoration was still being staged.
The state’s completion announcement reported full service restoration within four weeks and no ransom payment. It separated approximately 90% recovery of impacted data from residual data under review that was not required to restore services. Payroll was processed on schedule.
The state reported $1,314,200 obligated to specialist vendors and $210,599.87 in direct overtime wages. These are specified response-cost categories, not a complete measure of economic loss or a ransom payment.
Confidence and uncertainty
Confidence is high in ransomware and operational disruption because the state documented encrypted systems, a ransom note and service interruption. The attacker remains unidentified in the reviewed official record; ransomware confirmation does not establish attribution to a named group.
Data findings changed over time. Contemporaneous reporting quoted the CIO as saying data had been exfiltrated. The later forensic summary documented file access and data packaged for transfer but did not confirm successful extraction or publication. It reported notification to one former employee whose personal information appeared in the packaged material. The discrepancy remains explicit; the initial lack of evidence of personal-information compromise is not a final finding of no data impact.
Analytic gaps
The public record does not identify the attacker, reconcile the early exfiltration comments with the later forensic finding, establish a complete downstream loss total, or supply an exact calendar day for full restoration. A 28-day recovery duration should not be converted into a precise date without a dated completion milestone.
Operations are resolved based on the state’s affirmative account of statewide service restoration. Sept. 14, 2025 is the latest precise observation of continuing service effects in the reviewed primary notices. Residual data review is tracked separately from service restoration. The Nov. 5 report release does not restart the disruption clock.
Organizations involved
Impacted locations
Carson City, Nevada
Carson City is the capital and administrative site anchor of the affected state government. Statewide service effects are represented separately; this relationship does not assert that every city system or emergency service was offline.
Nevada
The state government described disrupted shared services across more than 60 agencies. The existing Nevada state boundary represents statewide governmental service reach, not universal interruption of all public functions or household internet access.
Sources
Our initial report described state-office closures, interrupted websites and phones, and a network incident discovered Aug. 24.
State offices paused in-person services while websites, online services and office phone lines could be intermittently unavailable. Statewide 911 call-taking remained available.
Contemporaneous reporting quoted Nevada’s CIO as saying attackers exfiltrated data; later state comments confirmed ransomware and ongoing analysis.
DMV offices reopened for vehicle transactions, testing and VIN inspections, while driver-license and ID-card transactions remained unavailable.
The Brady Firearms Unit background-check portal and telephone support resumed Sept. 14 at 8 a.m.; service stabilization and staged statewide restoration continued.
Nevada confirmed full service restoration within four weeks, no ransom payment and recovery of approximately 90% of impacted data.
The report traces initial compromise to May 14, 2025 and ransomware deployment to Aug. 24, and describes statewide service restoration within 28 days.
See something that needs correction?
Signed-in members can report an error, update, or missing source.