Cybersecurity Challenges in Nevada: Ransomware and Attacks

Hackers breached Nevada's government computer systems three months prior to a ransomware attack, according to an after-action report released by the state's Governors Technology Office. The report reveals that the attack, discovered on August 24, resulted in a 28-day disruption of crucial state services, including DMV operations and public databases.

Governor Joe Lombardo confirmed that the state did not pay a ransom and managed to recover approximately 90 percent of the affected data. The cybersecurity firm Mandiant found that the threat actor accessed systems as early as May 14, when a state employee unknowingly downloaded a malware-laden tool.

This tool created a hidden backdoor that allowed the attackers to maintain access to the system undetected until the ransomware was deployed. During the attack, the malicious actor accessed over 26,400 files, exposing 3,200 of them.

Fortunately, only one document containing personal identifying information was compromised, affecting a former state employee. State officials refrained from engaging the hackers regarding ransom demands to avoid provoking further attacks and to prevent incentivizing copycats.

The total cost of responding to the attack reached $1.5 million, which included $1.3 million spent on external vendor support and nearly $210,600 in overtime wages for state employees. Cybersecurity expert Greg Moody noted that Nevada's response was relatively swift compared to other incidents of this scale, which typically take months for recovery.

The remaining 10 percent of affected data is still under review, but officials assert that it was not needed to restore essential services. The report outlines recommendations for enhancing security measures, including limiting access for powerful accounts and investing in a centralized security operations center.

Cameron Call, a local cybersecurity expert, emphasized the need for the state to modernize its cybersecurity practices to avoid future vulnerabilities. The complete report is accessible online for further details.