Cyberattack kept Suffolk County from submitting $8.2 million in medical claims, report finds

Suffolk County was unable to submit more than $8 million in medical claims for services provided at six county-run methadone and mental health clinics after the September 2022 cyberattack, according to a newly released report.

Suffolk County Comptroller John Kennedy, whose office released the 16-page report on Wednesday, said he is hopeful that the county can still recover some of the money from Medicaid, Medicare and other private health insurance companies, even if some claims are past deadline.

"These were extraordinary exigent circumstances that nobody could have predicted," Kennedy said. "We should be able to get some relief and have the agencies at least review the veracity and the legitimacy of the claims and provide some reimbursement."

The report, which explicitly states that it is not a formal audit, says that the county has been unable to receive reimbursement for methadone dispersal and mental health services since the Sept. 8, 2022 attack. The hackers exploited a vulnerability in the county clerk's domain, a breach that exposed the Social Security numbers of nearly 500,000 residents and prompted county officials to shut down all systems including taking down the main website for months.

The review looked at data from January 2022 through December 2023, when the county served 1,100 people at four methadone clinics and 330 people at two mental health clinics. It estimated the loss at $8.2 million.

About 90% of claims in 2022 were for Medicare and Medicaid recipients, according to the report, and Kennedy said that is likely true for the following years. A 2023 breakdown is not included in the report.

Kennedy said those Medicare and Medicaid claims must be submitted electronically.

A spokeswoman for the Centers for Medicare and Medicaid Services, the federal agency overseeing those programs, could not immediately provide information on the likelihood of the county recouping some of the money. The spokeswoman also could not say if there was an alternative way the county could have submitted the claims.

Kennedy, a Republican and longtime political rival of former Suffolk County Executive Steve Bellone, a Democrat, has made frequent criticisms of his administration’s response to the cyberattack. Bellone, who left office Dec. 31, declined to comment.

The county migrated to a new medical recording system in August 2024 and is now submitting for all claims, according to Mike Martino, a spokesman for Republican Suffolk County Executive Edward P. Romaine.

"The Romaine administration continues to address the ripple effects of the costly 2020 cyberattack and its impact on the residents of Suffolk County," Martino said. "We continue to work every day to safeguard the county’s IT infrastructure and will work to rectify this situation as quickly as possible."

The report notes that patient data for visits between Sept. 9, 2022 and June 15, 2023 are printed out and in patient files at the clinics. It states that it would be "impossible" for health department staff to enter all the patient data into the new system while doing their current work. The report recommends directing staff from other county departments to help.

Both Kennedy and Martino said some of the data needed to submit the claims is in a "bubble," created to quarantine the old system after the cyberattack.

Suffolk County Health Commissioner Gregson Pigott, in a letter to Kennedy that is included in the report, said the cyberattack did not impact patient services and that the department will work with the county executive’s office to recover the funds.

"Despite this challenge, the department has continued to deliver services," he wrote.

By Vera Chinese

vera.chinese@newsday.com@VeraChinese

Vera Chinese covers Suffolk County government and politics. She joined Newsday in 2017 after working as an editor for the East End lifestyle publication northforker and a general assignment reporter for the New York Daily News.