Summary
This document is an After Action Report detailing the 2025 Statewide Cyber Incident experienced by the State of Nevada's Governor's Technology Office (GTO). The report outlines the timeline of events, beginning with the identification of a system outage on August 24, 2025, which was caused by a ransomware attack initiated through a compromised system administration tool downloaded by a state employee. The GTO's Incident Response Plan was activated, leading to the isolation of affected systems and engagement with cybersecurity experts. The investigation revealed that the threat actor accessed critical servers and deleted backup volumes before deploying ransomware. The report emphasizes the importance of a well-rehearsed incident response plan, collaboration with legal and cybersecurity professionals, and robust cybersecurity measures. It also highlights the role of executive leadership and strategic investments in cybersecurity infrastructure that facilitated a swift recovery, allowing the state to restore approximately 90% of the impacted data without paying the ransom. The report concludes with recommendations for future cybersecurity needs and enhancements.
