Nevada state officials refused to pay the ransom demanded and recovered approximately 90% of affected data over a 28-day recovery period. Reporting describes insurance coverage and pre-negotiated vendor agreements as factors in the decision not to pay.
This Is The Second Documented Refusal In The Corpus, And It Went Better
Saint Paul refused at 25-0815 and 43GB was published. Nevada refused and recovered nine tenths of its data.
The difference is not resolve. It is that Nevada could restore. An organisation with working backups is refusing a decryption demand it does not need; an organisation without them is refusing something it does need.
The Preparation Is The Whole Story
Insurance cover meant the recovery cost was funded rather than a fresh budget crisis. Pre-negotiated vendor agreements meant incident response and restoration capacity could be engaged immediately, at agreed rates, without procurement.
This corpus repeatedly records organisations buying emergency consultants at emergency rates during an incident — the mechanism behind the $1.76 million cost differential at 25-0325. Nevada had removed that from the critical path in advance.
None of it is glamorous. A contract, a policy and a tested restore are the three things that converted a 102-day intrusion into a recoverable event.
And The Ten Per Cent Matters
Ninety per cent recovery means data was permanently lost. In a state government estate covering DMV records, social services and law enforcement, that is not an abstraction — it is case files, applications and records that will have to be reconstructed or done without.
The corpus records the refusal as the right decision and the loss as real. Both, per 25-0819, fall on residents who had no alternative provider.
What It Does To The Payment Argument
The corpus now has three data points. PowerSchool paid and the data circulated anyway, at 25-0507. Saint Paul refused without the means to restore and lost the data publicly. Nevada refused with the means to restore and got most of it back.
The variable that predicts the outcome is not the payment decision. It is whether the organisation could recover without the attacker — which is decided months earlier, by people doing unfashionable work.
Compiled from published reporting of an official after-action account, listed below. The 90% figure is as reported by the state. Corrections: corrections@forensicpost.com.