{"id":73360,"date":"2025-10-21T19:25:05","date_gmt":"2025-10-21T23:25:05","guid":{"rendered":"https:\/\/statescoop.com\/?p=73360"},"modified":"2025-10-21T19:25:30","modified_gmt":"2025-10-21T23:25:30","slug":"nevadas-big-cyberattack-spurs-two-new-projects","status":"publish","type":"post","link":"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/","title":{"rendered":"Nevada’s big cyberattack spurs two new projects"},"content":{"rendered":"\n

During a legislative session held by Nevada\u2019s interim finance committee last week, the state\u2019s top technology official provided updates on the ransomware attack that disabled the state\u2019s executive branch last August, including a hint of what may have caused the incident, what recovery will cost and new work unfolding in the event\u2019s fallout.<\/p>\n\n\n\n

The committee ended up that session advancing some of the new work planned, approving more than $300,000 in funding for two new cybersecurity initiatives, including an expansion of the state\u2019s technical threat analysis program and greater support for an ongoing project to create a statewide security operations center. According to a state document<\/a>, the former would be funded with $150,000 in federal funding the state is receiving through the State and Local Cybersecurity Grant Program.<\/p>\n\n\n\n

Amid a barrage of probes and pontifications by state lawmakers during last Thursday\u2019s session, Timothy Galluzi, Nevada\u2019s chief information officer, explained that because an investigation of the cyberattack is still ongoing, there were many details he couldn\u2019t share, such as how the attack had been initiated. In responding to state Sen. Robin Titus, who erroneously connected the legislature not having been affected with the \u201creally good job\u201d that the branch\u2019s technical staff had done, Galluzi explained not how Nevada\u2019s attack began, but how such cyberattacks usually begin.<\/p>\n\n\n\n

\u201cRansomware attacks are generally either are from a compromise in your environment being brute forced or they come in as victim-initiated,\u201d such as when an employee opens a phishing email or downloads malware, he said, adding that the Governor’s Technology Office quickly isolated the attack and that the legislative branch\u2019s network had already been segmented off from the rest of the state.<\/p>\n\n\n\n

The ransomware attack<\/a> against Nevada disabled or disrupted numerous services for weeks, including the ability of police to conduct background checks, for residents to renew their driver\u2019s licenses or receive unemployment support or for small businesses to apply for permits through the secretary of state\u2019s office. The attack also opened the way for further attacks, which, although unsuccessful, increased roughly 300%, Gov. Joe Lombardo revealed last month<\/a>.<\/p>\n\n\n\n

Despite the cyberattack\u2019s effects, some of which persist, Galluzi said the state\u2019s $7 million cybersecurity-insurance policy will easily cover the state\u2019s direct recovery costs. Titus pointed out during the hearing that the costs haven\u2019t only been financial, and recalled hearing from gun dealers and residents who had been unable to access state systems, hurting their businesses and disrupting their lives. She told Galluzi: \u201cI just want you to be cognizant of that, that you are an employee of the state, but we represent our constituents.\u201d<\/p>\n\n\n\n

Galluzi said that the ransomware attack\u2019s wide-ranging effects were \u201cnot lost on my team.\u201d<\/p>\n\n\n\n

\u201cThey worked 18, 20-plus hour days for weeks,\u201d Galluzi said. \u201cThey didn’t take days off. They didn’t take vacation. They gave up holidays, they gave up everything just to get Nevada back to work, just to get all of those things back online for Nevadans. It wasn’t required of them. They volunteered it. And it was out of that sacred sense of duty, out of that sacred mission that they all believed in. It’s because they cared.\u201d<\/p>\n\n\n\n

Galluzi said the recovery process, which the state is conducting with<\/a> the Cybersecurity and Infrastructure Security Agency and the FBI, has so far shown that only \u201ca very incredibly small subset of internal data\u201d was exposed to the attackers and that he doesn\u2019t believe the personal data of any residents was compromised. He declined to answer many other questions raised by lawmakers, noting that a vendor the state is working with will help the state publish a more thorough report, after the investigation is over.<\/p>\n\n\n\n

He compared the recovery to \u201cdraining a Olympic size swimming pool with a garden hose,\u201d a project with limited capacity in which everyone urgently wants their services back online first. He said the state prioritized recovering public safety, followed by economic functions.<\/p>\n\n\n\n

At one point during the hearing, state Sen. Rochelle Nguyen asked whether a statewide security operations center might have allowed the state to avert the attack altogether, pointing out that one of the state\u2019s public safety divisions in 2023 requested $34 million to advance such a project, but never received the funding. Galluzi said it was impossible to know, but that because of the state\u2019s IT funding model, receiving funding for such a project can irritate his agency customers, which cover the costs of IT services in bills charged by the Governor\u2019s Technology Office.<\/p>\n\n\n\n

\u201cWhile I do believe that a statewide security operations center is imperative, it requires buy-in from all participants,\u201d Galluzi said.<\/p>\n\n\n\n

Adam Miller, deputy director at Nevada\u2019s Office of Information Security and Cyber Defense, also told Nguyen that it\u2019s impossible to know whether a SOC would have allowed the state to avert the cyberattack, but that the state\u2019s resources allowed it to catch the incident quickly, \u201ctriage\u201d and \u201crebuild.\u201d<\/p>\n\n\n\n

To frame Nevada\u2019s cyberattack, Galluzi pointed to recent high-profile attacks in the private sector, including the supply chain attack last August against Jaguar Land Rover that led the automaker to seek a $2 billion loan<\/a> to help with its recovery costs. He also pointed to recent cyberattacks that compromised 1 billion records held by Salesforce customers<\/a>. Galluzi summarized by pointing out that there\u2019s more to cybersecurity than money, something that both Salesforce and Jaguar have a lot of.<\/p>\n\n\n\n

While formulating a follow-up question for Galluzi about the relevance of the Salesforce attack, such as whether it compromised any of Nevada\u2019s data \u2014 (it didn\u2019t) \u2014 state Sen. Dina Neal seemed to stumble upon the koan at the center of all security matters: \u201cHow do you protect a system when everyone is subject to being hackable?\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"

Nevada Chief Information Officer Timothy Galluzi asked for and received permission from state lawmakers to spend $300,000 on new cybersecurity projects.<\/p>\n","protected":false},"author":205,"featured_media":70944,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"disable_grayscale_images":true,"grayscale_contrast":0,"sponsored_content":false,"display_author_bio":true,"story_type":"","footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[4677],"tags":[19,213,3973,16536,17935,23370,23566,24746,24756],"people":[],"special-report":[],"authors":[4696],"class_list":["post-73360","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-state","tag-ransomware","tag-nevada","tag-state-government","tag-cybersecurity","tag-chief-information-officer","tag-cyberattacks","tag-timothy-galluzi","tag-government-it","tag-state-legislature","author-colin-wood"],"yoast_head":"\nNevada's big cyberattack spurs two new projects | StateScoop<\/title>\n<meta name=\"description\" content=\"Nevada Chief Information Officer Timothy Galluzi asked for and received permission from state lawmakers to spend $300,000 on new cybersecurity projects.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Nevada's big cyberattack spurs two new projects | StateScoop\" \/>\n<meta property=\"og:description\" content=\"Nevada Chief Information Officer Timothy Galluzi asked for and received permission from state lawmakers to spend $300,000 on new cybersecurity projects.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/\" \/>\n<meta property=\"og:site_name\" content=\"StateScoop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/StateScoop\/\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-21T23:25:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-21T23:25:30+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/05\/GettyImages-2173151358.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1300\" \/>\n\t<meta property=\"og:image:height\" content=\"867\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Colin Wood\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@State_Scoop\" \/>\n<meta name=\"twitter:site\" content=\"@State_Scoop\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/\",\"url\":\"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/\",\"name\":\"Nevada's big cyberattack spurs two new projects | StateScoop\",\"isPartOf\":{\"@id\":\"https:\/\/statescoop.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/05\/GettyImages-2173151358.jpg\",\"datePublished\":\"2025-10-21T23:25:05+00:00\",\"dateModified\":\"2025-10-21T23:25:30+00:00\",\"description\":\"Nevada Chief Information Officer Timothy Galluzi asked for and received permission from state lawmakers to spend $300,000 on new cybersecurity projects.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/#primaryimage\",\"url\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/05\/GettyImages-2173151358.jpg\",\"contentUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/05\/GettyImages-2173151358.jpg\",\"width\":1300,\"height\":867,\"caption\":\"(Getty Images)\"},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/statescoop.com\/#website\",\"url\":\"https:\/\/statescoop.com\/\",\"name\":\"StateScoop\",\"description\":\"Latest news and events in state and local government technology\",\"publisher\":{\"@id\":\"https:\/\/statescoop.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/statescoop.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/statescoop.com\/#organization\",\"name\":\"StateScoop\",\"url\":\"https:\/\/statescoop.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/statescoop.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png\",\"contentUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png\",\"width\":1470,\"height\":186,\"caption\":\"StateScoop\"},\"image\":{\"@id\":\"https:\/\/statescoop.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/StateScoop\/\",\"https:\/\/x.com\/State_Scoop\",\"https:\/\/www.linkedin.com\/company\/statescoop\/\",\"https:\/\/www.youtube.com\/@StateScoop\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Nevada's big cyberattack spurs two new projects | StateScoop","description":"Nevada Chief Information Officer Timothy Galluzi asked for and received permission from state lawmakers to spend $300,000 on new cybersecurity projects.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/","og_locale":"en_US","og_type":"article","og_title":"Nevada's big cyberattack spurs two new projects | StateScoop","og_description":"Nevada Chief Information Officer Timothy Galluzi asked for and received permission from state lawmakers to spend $300,000 on new cybersecurity projects.","og_url":"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/","og_site_name":"StateScoop","article_publisher":"https:\/\/www.facebook.com\/StateScoop\/","article_published_time":"2025-10-21T23:25:05+00:00","article_modified_time":"2025-10-21T23:25:30+00:00","og_image":[{"width":1300,"height":867,"url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/05\/GettyImages-2173151358.jpg","type":"image\/jpeg"}],"author":"Colin Wood","twitter_card":"summary_large_image","twitter_creator":"@State_Scoop","twitter_site":"@State_Scoop","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/","url":"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/","name":"Nevada's big cyberattack spurs two new projects | StateScoop","isPartOf":{"@id":"https:\/\/statescoop.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/#primaryimage"},"image":{"@id":"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/#primaryimage"},"thumbnailUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/05\/GettyImages-2173151358.jpg","datePublished":"2025-10-21T23:25:05+00:00","dateModified":"2025-10-21T23:25:30+00:00","description":"Nevada Chief Information Officer Timothy Galluzi asked for and received permission from state lawmakers to spend $300,000 on new cybersecurity projects.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/#primaryimage","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/05\/GettyImages-2173151358.jpg","contentUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/05\/GettyImages-2173151358.jpg","width":1300,"height":867,"caption":"(Getty Images)"},{"@type":"WebSite","@id":"https:\/\/statescoop.com\/#website","url":"https:\/\/statescoop.com\/","name":"StateScoop","description":"Latest news and events in state and local government technology","publisher":{"@id":"https:\/\/statescoop.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/statescoop.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/statescoop.com\/#organization","name":"StateScoop","url":"https:\/\/statescoop.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/statescoop.com\/#\/schema\/logo\/image\/","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","contentUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","width":1470,"height":186,"caption":"StateScoop"},"image":{"@id":"https:\/\/statescoop.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/StateScoop\/","https:\/\/x.com\/State_Scoop","https:\/\/www.linkedin.com\/company\/statescoop\/","https:\/\/www.youtube.com\/@StateScoop"]}]}},"parsely":{"version":"1.1.0","canonical_url":"https:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/","smart_links":{"inbound":0,"outbound":0},"traffic_boost_suggestions_count":0,"meta":{"@context":"https:\/\/schema.org","@type":"NewsArticle","headline":"Nevada’s big cyberattack spurs two new projects","url":"http:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/","mainEntityOfPage":{"@type":"WebPage","@id":"http:\/\/statescoop.com\/nevadas-big-cyberattack-spurs-two-new-projects\/"},"thumbnailUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/05\/GettyImages-2173151358.jpg?w=150&h=150&crop=1","image":{"@type":"ImageObject","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/05\/GettyImages-2173151358.jpg"},"articleSection":"State","author":[{"@type":"Person","name":"Colin Wood","url":"https:\/\/statescoop.com\/author\/colin-wood\/"}],"creator":["Colin Wood"],"publisher":{"@type":"Organization","name":"StateScoop","logo":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/cropped-ss_favicon.png"},"keywords":["chief information officer","cyberattacks","cybersecurity","government it","nevada","ransomware","state government","state legislature","timothy galluzi"],"dateCreated":"2025-10-21T23:25:05Z","datePublished":"2025-10-21T23:25:05Z","dateModified":"2025-10-21T23:25:30Z"},"rendered":"<script type=\"application\/ld+json\" class=\"wp-parsely-metadata\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"NewsArticle\",\"headline\":\"Nevada’s big cyberattack spurs two new projects\",\"url\":\"http:\\\/\\\/statescoop.com\\\/nevadas-big-cyberattack-spurs-two-new-projects\\\/\",\"mainEntityOfPage\":{\"@type\":\"WebPage\",\"@id\":\"http:\\\/\\\/statescoop.com\\\/nevadas-big-cyberattack-spurs-two-new-projects\\\/\"},\"thumbnailUrl\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2025\\\/05\\\/GettyImages-2173151358.jpg?w=150&h=150&crop=1\",\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2025\\\/05\\\/GettyImages-2173151358.jpg\"},\"articleSection\":\"State\",\"author\":[{\"@type\":\"Person\",\"name\":\"Colin Wood\",\"url\":\"https:\\\/\\\/statescoop.com\\\/author\\\/colin-wood\\\/\"}],\"creator\":[\"Colin Wood\"],\"publisher\":{\"@type\":\"Organization\",\"name\":\"StateScoop\",\"logo\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2023\\\/01\\\/cropped-ss_favicon.png\"},\"keywords\":[\"chief information officer\",\"cyberattacks\",\"cybersecurity\",\"government it\",\"nevada\",\"ransomware\",\"state government\",\"state legislature\",\"timothy galluzi\"],\"dateCreated\":\"2025-10-21T23:25:05Z\",\"datePublished\":\"2025-10-21T23:25:05Z\",\"dateModified\":\"2025-10-21T23:25:30Z\"}<\/script>","tracker_url":"https:\/\/cdn.parsely.com\/keys\/statescoop.com\/p.js"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/05\/GettyImages-2173151358.jpg","distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"StateScoop","distributor_original_site_url":"https:\/\/statescoop.com","push-errors":false,"_links":{"self":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/73360","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/users\/205"}],"replies":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/comments?post=73360"}],"version-history":[{"count":2,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/73360\/revisions"}],"predecessor-version":[{"id":73363,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/73360\/revisions\/73363"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/media\/70944"}],"wp:attachment":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/media?parent=73360"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/categories?post=73360"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/tags?post=73360"},{"taxonomy":"people","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/people?post=73360"},{"taxonomy":"special-report","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/special-report?post=73360"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/authors?post=73360"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}