LAS VEGAS — One year after a widespread cyberattack crippled Nevada state services and left residents struggling to access assistance, state officials say they have bolstered defenses with new technology, policy changes and heightened awareness across agencies.
Investment and hardening of systems
Tim Galluzi, chief information officer of the Governor's Technology Office, said the response to the breach that began in late August 2025 has involved both technical upgrades and procedural reforms. The office has directed about $14 million toward cybersecurity investments and has implemented what he described as enterprise-level hardening.
The upgrades included tightened authentication requirements across internal logins, expanding the use of multi-factor authentication, and new tools designed to detect and halt intrusion attempts more quickly. Galluzi said those measures have helped state IT teams respond to subsequent probing attempts that did not reach the scale of last year’s attack.
"It's been quite the year. We've been incredibly busy," Galluzi said. "Yes, absolutely. I wouldn't say threats at the same level, but attempts. We've been able to squash those attempts pretty rapidly."
Standardizing data protections
Another major change is a statewide system for classifying data, replacing a patchwork approach in which individual agencies maintained their own protection levels. State officials said data is now sorted into four tiers: public, sensitive, confidential and restricted. The standardized framework is intended to make it clearer which datasets require the strongest security controls and to ensure consistent protections across agencies.
Officials also instituted a third-party review process for cloud-based services to more closely vet vendors and configuration practices when state data and applications run outside of Nevada’s own infrastructure.
Awareness as a central defense
Galluzi emphasized that technology is only part of the solution and singled out organizational awareness as a critical factor. Officials pointed out that even with substantial spending on security, all organizations remain potential targets and that human behavior—such as credential management and prompt reporting of suspicious activity—plays a major role in resilience.
State leadership publicly confirmed that Nevada declined to pay the ransom demanded by the 2025 hackers. While the state opted not to pay, officials have acknowledged the incident entailed significant operational costs and disruption; the exact total expense of the response has not been disclosed publicly.
Practical implications for residents and agencies
For Nevada residents, the stated improvements aim to reduce future interruptions to unemployment systems, social services portals and other state-run platforms that were affected during the incident. For state employees and agency IT teams, the changes mean new authentication workflows, updated vendor oversight processes and clearer guidelines about classifying and handling data.
- New investments: $14 million directed to cybersecurity tools and services.
- Authentication: expanded multi-factor authentication and tightened login controls.
- Data classification: four statewide tiers—public, sensitive, confidential, restricted.
- Vendor oversight: mandatory third-party reviews for cloud-based technology.
Ongoing vigilance and future steps
Galluzi said attempts to compromise systems have continued since the initial incident but that more recent intrusions were detected and neutralized faster because of the new capabilities. He also framed the work as ongoing, noting that cyber defenses require continual updates and cooperation among state agencies and external partners.
Federal and state investigations into last year’s intrusion remain part of the broader picture, reflecting the complex, cross-jurisdictional nature of major cyber incidents. State officials have said they will continue to publish after-action findings and incorporate lessons learned into future planning.
As Nevada marks the anniversary, officials are urging residents and local organizations to adopt basic cybersecurity hygiene—strong, unique passwords, use of multi-factor authentication, and prompt reporting of suspicious communications—as part of a shared effort to reduce vulnerability to future cyberattacks.
