Suffolk Hack: Residents Told Obtain Credit Report, Look Over With Care | #itsecurity | #infosec | #hacking | #aihp

HAUPPAUGE, NY — Hackers either accessed or acquired residents’ personal information from one or more Suffolk County agency servers during the Sept. 8 cyberattack in Suffolk County, officials announced on the county’s webpage.

The county promptly hired multiple cybersecurity firms “to conduct an examination to protect employees and residents as well as restore online services,” the announcement said.

Residents affected by the breach will be notified as required by law, and they will be offered free identity theft protection services, according to county officials.

“The assessment is ongoing,” the county said. “Suffolk County wants to ensure that employees, residents, and stakeholders are informed about precautionary measures they can take to help them protect themselves from becoming victims of fraud or identity theft.”

Officials suggested that county residents regularly review statements from their accounts and then periodically obtain their credit reports from one or more of the national credit reporting companies.

“When you receive your credit report, look it over with care,” the announcement continued. “If you notice anything suspicious — accounts you did not open, inquiries from creditors that you did not initiate, personal information such as a home address or social security number that is not accurate — or you see anything you do not understand, call the credit reporting agency at the number listed in the report.”

Officials suggested that anyone who finds fraudulent or suspicious activity on their credit report to “promptly report the matter to the proper law enforcement authorities.”

In a Thursday statement to Newsday, County Executive Steve Bellone said “the protection of personal information is a top priority of the county and we will notify directly any individual whose data may have been exposed and offer free identity theft protection services.”

County officials recommended placing a fraud alert or a security freeze on personal credit files, as well as remaining vigilant with continued monitoring. For a complete list of suggestions, click here.

The county’s web-based applications, including the web pages for its various departments, and email were taken down Sept. 8 after officials learned of unusual activity, later deemed a ransomware attack.

Email was restored in some county agencies, like the police department, last week. But while the department’s Public Information Bureau was able to send and receive email, the department did not have access to the Computer Assisted Database, hampering its response to members of the press.

The criminal hacker group “BlackCat” has since claimed responsibility and has threatened to leak secure files, according to posts on the dark web.

Documents that were published by the group on the dark web included speeding tickets, court records, and a handwritten marriage license from 1908, Newsday reported.

BlackCat also announced members were seeking a “small reward,” according to the outlet.

County officials began operating “old school” last week, reverting to the 1990s, as investigators examined the county’s web files.

The police are currently writing information and filing using an old school system due to a ransomware attack, but the department is expected to be back online using newer technology by the end of the week, according to a report by News 12.

The state’s Department of Homeland Security and Emergency Service provided “a highly-sophisticated technology that will provide additional firewall protection allowing the department to bring its Computer-Assisted Database back online safely and securely,” Commissioner Rodney Harrison told the outlet in a news conference in Yaphank on Monday.

Related Stories: