Incident Response and Ransomware Recovery in Reno

Incident response is what happens when an attack gets through: our SOC team contains it, investigates what happened, preserves evidence and guides recovery alongside your IT provider. It is included in both plans for Reno, Sparks and Carson City businesses. Clients who suspect a breach should call (775) 238-9281 right away.

Get a free assessment Included in both plans
Right now

The first-hour checklist.

  1. Isolate, do not power off. Unplug network cables or disable Wi-Fi on affected machines, but leave them on.
  2. Do not wipe or restore yet. Rebuilding now destroys the evidence that shows how they got in.
  3. Call your incident response provider and your insurer. Most cyber policies require prompt notice and may specify which vendors to use.
  4. Move sensitive talk off email. Assume the attacker can read your mailbox until proven otherwise.
  5. Write it down. What you saw, when, and who touched what.
Do not

Common mistakes that make it worse.

  • Paying the ransom before you know what was taken and whether backups survived.
  • Restoring from backups that may already contain the attacker's tools.
  • Resetting a few passwords and calling it done while the attacker still has another way in.
  • Making public statements before you know the facts. Notification deadlines still apply, so involve counsel early.
Our process

From containment to lessons learned.

Our approach is informed by NIST SP 800-61 Revision 3, which ties incident response to the Detect, Respond and Recover functions of the NIST Cybersecurity Framework 2.0.1

  1. Identify and scope

    Confirm the incident, find affected systems and accounts, and work out how the attacker got in.

  2. Contain

    Isolate devices with EDR, disable compromised accounts, block attacker infrastructure and cut off remote access paths.

  3. Eradicate

    Remove the attacker's tools, backdoors and persistence, and close the hole they used.

  4. Recover

    Guide your IT provider as systems are restored from clean backups in priority order, verify they are clean and watch closely for the attacker's return.

  5. Lessons learned

    A written report for leadership, your insurer and counsel, plus the fixes that keep it from happening again.

The ransom question

Should you pay?

The FBI and CISA advise against it.2 Payment does not guarantee working decryption or the deletion of stolen data, and it marks you as a business that pays. Verizon's 2025 Data Breach Investigations Report found the median ransom payment was $115,000 and that 64 percent of victims refused to pay.3

Your best leverage is backups the attacker could not reach. Ransomware resilience means at least one immutable or offline copy and restores that have actually been tested.

Insurance and notification

Working with insurers and counsel.

Cyber insurers expect prompt notice and good documentation. We record what was detected, what was affected and every action taken, so you can share it with your insurer and the breach counsel your policy names.

Nevada's breach law, NRS 603A, requires notice to affected Nevada residents when their personal information is acquired without authorization. HIPAA and the FTC Safeguards Rule carry their own deadlines. Counsel makes the legal call; we give them the facts.

Close to home

Lessons from the 2025 Nevada ransomware attack.

In August 2025, a ransomware attack on the State of Nevada's network took state websites offline and closed DMV offices statewide, and officials confirmed data was stolen.4,5 The lessons apply to any Reno or Carson City business:

  • Attackers often sit inside a network quietly before they strike, so detection matters more than prevention alone.
  • Recovery speed depends on knowing which systems matter most and having tested backups for them.
  • Clear, fast communication with customers limits the damage to trust.

The best incident is the one caught early. Our managed detection and response and managed security services are built to stop intrusions before they become incidents. Healthcare practices and law firms are frequent targets.

Sources:
  1. NIST SP 800-61 Rev. 3, Incident Response Recommendations
  2. CISA, #StopRansomware
  3. Verizon, 2025 Data Breach Investigations Report
  4. KOLO 8, "Nevada DMV closes after cyberattack," August 27, 2025
  5. FOX5 Las Vegas, "Nevada officials: Data stolen from state network in ransomware cyberattack," August 27, 2025
Common questions

Incident response FAQ

Disconnect affected devices from the network but leave them powered on, so evidence in memory is not lost. Do not wipe or rebuild anything yet. Call your incident response provider and your cyber insurance carrier's claims line. Switch to phone calls for sensitive conversations in case email is compromised, and write down what you saw and when.
Yes, and it should. Most cyber policies require you to notify the carrier quickly and may require approved response vendors or breach counsel. We document what happened, what was affected and what we did, so your insurer and attorneys have the facts they need.
Costs vary with the size of the incident and, above all, whether clean backups exist. Restoring from offline backups is usually much cheaper and faster than rebuilding systems from scratch. For clients on our plans, our incident response work is included in the monthly price; restoration work by your IT provider or a data recovery specialist is billed by them.
The FBI and CISA advise against paying. Payment does not guarantee you get your data back, and it funds further attacks. Verizon's 2025 Data Breach Investigations Report found 64 percent of victim organizations did not pay. The decision belongs to your leadership with advice from counsel and your insurer; our job is to give you the facts and the fastest recovery path that does not depend on paying.
Often, yes. Nevada's breach notification law, NRS 603A, requires businesses to notify affected Nevada residents in the most expedient time possible when unencrypted personal information, as the statute defines it, is acquired by an unauthorized person. HIPAA, the FTC Safeguards Rule and contracts may add other deadlines. Your breach counsel makes the legal call; we supply the facts they need.

Find out where your business is exposed.

Book a free, comprehensive cybersecurity risk assessment. See where your business is exposed and what to fix first. No cost, no contract.

Get a Free Assessment Call (775) 238-9281