Day care providers struggled amid Suffolk cyberattack payment delays

Child care providers across Suffolk who struggled with delayed payments from the county following the Sept. 8 ransomware attack are finally receiving overdue payments over the past month, county officials and providers say, but impacts and concerns linger.

Earlier this month, Newsday spoke with child care providers who rely to varying degrees on payments from the county’s Department of Social Services after many said payments had been delayed for more than two months, with little explanation from Suffolk.

The cyberattack shut down a broad cross-section of county services, hobbling telephone and email systems and impacting the police department, Department of Health Services, the Traffic and Parking Violations Agency and other departments. On Wednesday, the county acknowledged that the Traffic and Parking Violation Agency’s server was "compromised and certain personal information may have been accessed by the criminal actor."

Asked whether day care providers’ information may have been compromised, Suffolk spokeswoman Marykate Guilfoyle said, “While the forensic assessment is ongoing, there is no indication that this data has been impacted.” She noted “precautionary measures” people can take are listed on the county’s website.

Guilfoyle said payments to providers contacted by Newsday were restarted after weeks of delays, not months, beginning Oct. 5.

Jennifer Rojas, executive director of the Child Care Council of Suffolk, a nonprofit support agency for providers and parents, said the cyberattack only exacerbated problems for an industry already in crisis because of low margins and difficulty in hiring help.

“This industry is really crippled right now,” said Rojas, who added she wasn’t blaming Suffolk for the attack's impact and that new state grants to providers were also delayed. “Even a short delay in getting payments to these providers can have a very big impact."

Many day care providers depend on the county subsidies to fund their operations, and those whose businesses depended the most on the payments had begun dipping into their own coffers to help fund operations until payments came through, some providers said.

Last week, Suffolk said it had caught up on most of those payments.

Prior to the cyber intrusion, there already was a 30-day processing time for day care vouchers, “meaning a provider would submit a voucher for January's services in February, and would receive payment in March,” Guilfoyle said in a statement to Newsday.

“Despite the cyber intrusion,” she said, the Department of Social Services has been able to “quickly process” vouchers, with only a “minimal delay.” But payments have only caught up in recent weeks, because payments are only made by check through the county comptroller’s office after Suffolk processes them.

“On average, vouchers are being processed within 35 days and any voucher received by October 11th has been sent to the Comptroller's office for payment,” Guilfoyle wrote. “This equates to more than 300 payments since the cyber intrusion.”

But providers who spoke to Newsday painted a considerably different picture, including one who said delayed payments with little formal explanation ultimately led her to shut down her day care operation, which had been in business for more than 12 years.

Others expressed concern about possible impacts on their company and personal information, and those of the children in their care, and said the county had not offered them any written assurances that it had not been compromised.

“A big part of this is we don’t know the nature of what was hacked,” said Michele Kessler, owner of An Apple A Daycare in Bayport.

“Yes, we’ve been inconvenienced, negatively impacted, but what is the full fallout and are we going to be experiencing this down the road because all of our financial information, banking numbers, business IDs, children’s birthdays” may have been compromised? Kessler said. “We’re not being treated like the essential workforce that we are.”

‘Nothing we can do because of the hack’

In the end, the latest round of delayed payments from Suffolk to cover the costs of running her Craft and Learn Daycare center in Bay Shore were just too much for owner Jackie Guzman. “I closed down at the end of September,” she said, leaving families of up to 25 children she cared for scrambling.

Guzman said she didn’t even learn that the ransomware attack was the reason for the latest extended delay of payments until after she’d closed down. “When I didn’t get my checks, I called and said what’s going on? They said there’s nothing we can do because of the hack,” she said.

Other day care centers said they faced similar delays and stark choices. Some have had to use credit cards or untouched business loans to tide them over until payments come. Others said they worried if their private business information — banking accounts, Social Security numbers, client information — has been exposed as a result of the hack and could be compromised. Suffolk, they said, has not communicated directly with any of them.

“Payments have always been delayed and it’s always a challenge to get in contact with the staff,” said Jen Lamaina, owner of Bright and Early Discoveries in Riverhead, where around 60% of the children she cares for are subsidized by the Department of Social Services. “They’re always behind one month, but never anything like this. I haven’t received September’s payment,” she said in early November.

Contacted Monday, Lamaina said she had received some payments the weekend before Thanksgiving. “I’m not fully caught up, but it was nice to finally get payments,” she said.

Still, she said, Suffolk hasn’t reached out to providers to explain anything about personal or banking information that may have been compromised.

“Normally, with credit card companies, there’s some kind of communication, but with this there isn’t anything to say what can we do or what they’re doing to protect our information,” she said. “Nothing.”

'Zero communication'

Kessler said her business relies on the county to provide referrals of seven or eight Department of Social Services children a month for her day care, which has primarily private-pay clients. She said she hadn’t received a referral since September, leaving those seven spots vacant in a county where day care is considered in short supply. On Tuesday, however, she said she received her first referral in months.

“We shouldn’t have to be on our own filling our coffers from our own pockets,” she said. “That’s not how this is supposed to work, and it’s really infuriating that everybody is OK with that. They treat us like babysitters, not like a professional industry.”

Kessler’s main gripe is that there has been “zero communication” from the county. “If I hadn’t happened to have a newspaper subscription and cable news, I would not have had this information,” she said. 

Sharlene Mangles, co-owner and chief operating officer of Kidtastic Kids in Farmingville, was already months late in receiving payments from the Department of Social Services to cover children in her day care program when the ransomware attack hit.

“Any center that accepts DSS students, we’re already delayed” in getting paid, Mangles said. “Our checks are late and at a much lower rate than expected … It’s unfortunate that we have to fight like this for money that is owed to us.”

One provider, Darcy Leone, owner of Darcy's Tots in Lake Ronkonkoma, said the situation has “greatly improved” in recent weeks.

“There was a backlog of a few months, unfortunately,” said Leone. But now, she said, it’s her understanding that the Department of Social Services has “pretty much caught up.” The problem, she said, was that “because of the cyberattack, everything had to be done manually. That’s why it took so long.”

Suffolk Comptroller John Kennedy, whose office manages vendor disbursements, said he’s had staff working overtime to hand-process checks and that the payments to day care providers were catching up.

Kennedy said last week that he was told the county was "probably current through mid-October" in making payments to day care providers, adding, "I can tell you in dealing with the folks at DSS, I can't criticize the [Bellone] administration."

But he said the backlogs on payments on the whole will ripple into next year.

“It is massive. It will portend consequences into next year,” Kennedy said. “There will be no return to normalcy until well into 2023."

By Mark Harrington

mark.harrington@newsday.comMHarringtonNews

Mark Harrington, a Newsday reporter since 1999, covers energy, wineries, Indian affairs and fisheries.