Suffolk County’s IT systems are still down from September 8 due to a cyberattack that has left the county reverting back to antiquated paper systems as phone systems, email, and websites continue to remain largely off limits.
Suffolk County Executive Steve Bellone initially claimed the cyberattack investigation did not necessarily mean that there was a ransomware attack, even though “hallmarks of ransomware” were detected.
However, three days after Bellone had his press conference to release this information, a ransomware team called “Black Cat” (or ALPHV) officially claimed responsibility for the attack.
According to databreaches.net, the ransomware team issued a post on their dark web leak site that reads:
“The Suffolk County Government was attacked. Along with the government network, the networks of several contractors were encrypted as well.
Due to the fact that Suffolk County Government and the aforementioned companies are not communicating with us, we are publishing sample documents extracted from the government and contractor network.
The total volume of extracted files exceeds 4TB.
Extracted files include Suffolk County Court records, sheriff’s office records, contracts with the State of New York and other personal data of Suffolk County citizens. We also have huge databases of Suffolk County citizens extracted from the clerk.county.suf. domain in the county administration.”
Accompanied with the post were screenshots of files that visibly have been taken from county systems. While some of these files appear to be court documents and speeding tickets, it is proof that personal information has been confiscated. It is believed that the less sensitive
material will be released first in effort for the hackers to press the county to negotiate.
The following personal information may have been included in the leak: social security numbers, tax payments, criminal records, net worth, salary, and other potentially damaging information. Suffolk County has not commented on if this type of information has been leaked, nor has it been confirmed if a monetary request has been made.
“While the assessment into the cyber intrusion continues, today the county submitted formal notification of a data breach to the Attorney General’s Office in accordance with New York State law. The nature and extent of that breach remains under examination and the county will notify directly any individual whose data may have been exposed and offer free identity theft protection services,” said Suffolk County Executive Steve Bellone in a statement released on Tuesday.
Bellone has also confirmed that the county’s IT Department has been diligently working alongside law enforcement agencies with extreme efforts to “proceed with the safe and secure restoration of services.”
At a press conference on Monday that took place outside of Suffolk County Police Headquarters in Yaphank, police Commissioner Rodney Harrison thanked the state for their support as well as NYPD for “providing us with some relief as we continue to navigate through this cyber intrusion.”
Harrison advised that the NYPD has aided the county by providing five additional emergency call operators per tour. In addition to this, Harrison also thanked the NYS Department of Homeland Security and Emergency Services for their efforts in providing additional firewall security, which will hopefully get computers back up and running safely.
In the meantime, 9-1-1 calls have been recorded by hand, with the information passed by the “runners” to a dispatcher. Commissioner Harrison hoped to have the 911 call system back to normal by Friday.
While the county website is still down, there is a temporary landing page at suffolkcountyny.gov
[Correction: Last week, an article ran with a quote claiming residents cannot pay taxes owed to Suffolk County. Residents can still pay their taxes in person.]
