Former Steve Bellone deputy defends Suffolk County cyberhack response

A top official under former Suffolk County Executive Steve Bellone defended the county’s response to the September 2022 cyberattack during testimony Wednesday before a legislative committee but refused to answer when asked whether she deleted related information from her work computer.

Former Chief Deputy County Executive Lisa Black, who led the county’s response to the cyberhack, answered questions for 3½ hours from members of the Suffolk County Legislature’s Cyberattack Investigation Committee, which was formed in 2023 to find the source of the crippling breach.

Black reiterated the Bellone administration’s position that the attack originated through an unpatched vulnerability in the county clerk’s network, which is independent of the countywide information technology department. She also downplayed the hack’s long-term effect on county government.

“We did a lot of very important work together and we can take pride in the fact that ultimately this event impacted less than 2% of county systems, all backups are retained or restored, or rebuilt, and this county did not pay a ransom to criminal actors,” Black told legislators.

She was referring to $2.5 million demanded by the hackers, which Bellone later said had been reduced to $650,000.

The attack took some county systems and websites offline for months and exposed the personal information of more than 400,000 people. The county approved more than $16 million in spending to outside vendors to shore up its computer system from attack, according to purchase orders Newsday obtained through a Freedom of Information Law request.

Political rivals of Bellone, a Democrat who was term-limited and left office in December, have repeatedly criticized his administration’s cyber preparedness, use of emergency orders to procure no-bid contracts and failure to hire a chief information security officer before 2023.

Bellone had blamed former County Clerk IT director Peter Schlussler for failing to fix what is known as a “log4j” vulnerability and placed him on leave from December 2022 until December 2023. Schlussler has denied Bellone’s claim and previously testified that the county missed numerous opportunities to prevent the attack months before it happened.

A representative for Suffolk County District Attorney Ray Tierney told Newsday in March the office was investigating allegations that members of the Bellone administration “improperly destroyed” and removed county data as they left office last year. On Wednesday, a representative for Tierney declined to comment on a request for an update on the investigation.

During her testimony, Black acknowledged that Tierney's office sent out a memo in December 2022 indicating that all records related to the cyberattack were to be preserved. Black testified the county attorney sent out a memo stating that county emails could not be deleted.

Legis. Anthony Piccirillo (R-Holtsville), the committee chair, questioned Black on why all data on her computer, including the machine’s operating system, was deleted when she left county service at the end of the year.

“She's not going to answer that question,” said Black’s attorney, David Kelley. “It's a subject, reportedly, from a district attorney's investigation and they can pursue it and contact her if they wish.”

“The witness refuses to answer the question,” Piccirillo said. “Let the record reflect.”

Black testified that Suffolk County Clerk Vince Puleo had “intimated” that it would be a good idea for Bellone to continue extending emergency orders allowing the county to keep Schlussler on leave throughout the cyberhack response. Puleo, who took office in January 2023, told Newsday he had only asked that an IT employee who had subsequently been assigned to the clerk’s office remain there until the completion of upgrades to system security.

“I had no conversation about making sure that Pete was not coming back to my office,” Puleo said in a phone interview after the committee meeting. “I didn't want to upset continuity that was going on in the clerk's office in making sure that all of our servers were clean and scrubbed.”

Schlussler, who said he now works in the office of Suffolk County Comptroller John Kennedy, a vocal Bellone critic, declined to comment on the remarks.

Correction: Attorney David Kelley represented former Chief Deputy Suffolk County Executive Lisa Black at a legislative hearing Wednesday. Kelley's name was misspelled in an earlier version of this story.

By Vera Chinese

vera.chinese@newsday.com@VeraChinese

Vera Chinese covers Suffolk County government and politics. She joined Newsday in 2017 after working as an editor for the East End lifestyle publication northforker and a general assignment reporter for the New York Daily News.