Suffolk cyberattack backs up tax-refund system for months

A Suffolk County process for remitting refund checks to those who successfully grieve their property-tax assessments has been backlogged since the crippling Sept. 8 cyberattack on county government, delaying tens of million of dollars in refund payments.

Payments from the system to those eligible for refunds because of prior-year overpayments typically runs just under $50 million a year, according Suffolk County Comptroller John Kennedy.

He acknowledged his office is severely backlogged in making payments that arise as a result of the Small Claims Assessment Review system since the Sept. 8 ransomware attack. A similar delay applies to Article 7 commercial tax-grievance reviews.

Kennedy said he accepted part of the blame because earlier in the year he had put most of his staff to work on more pressing payment matters. “I will take some ownership of the delay of SCARs,” he said. But the problem has been sharply worsened by the September loss of his financial management system, which is returning to full functionality this month.

The small-claims process is initially filed in the New York State court system and can take up to a year for a decision, either from a judge or a settlement. Such a decision can lower a person’s taxes for the year of the judgment, but the refund, which applies from the date of filing, has a lag time for remittance. Customers who use third-party tax-grievance services often pay those services in advance when there’s a decision in their favor, and wait for the refund to help cover the costs.

Firms whose clients rely on the SCAR system say clients are feeling the delays.

“We’re telling clients it could be 18 months” before checks are sent for the 2021 tax year, said Eric Andrews, office manager for the Mark Lewis Tax Grievance Service in Farmingville. “We’re still waiting on people who filed in 2020 and that was before the cyberattack,” he said.

“It’s frustrating," Andres said. "Some people are waiting on a few thousand dollars.”

Still, Andrews noted, clients do see a tax-bill reduction in the tax year for which the grievance was successful.

For the county, part of the problem has been the loss of the comptroller’s financial management computer system as a result of the cyberattack, a problem that has delayed upward of $200 million in county payments to numerous vendors and could push some into next year, Kennedy said. The system was “not available at full speed,” and a statutory 90-day deadline for processing and cutting checks for payments “turned into five months,” said a person familiar with the system.

"It's yet another consequence of the hack," said Kennedy, estimating that a normal 12-week lag starting in June has extended to a "22-week interruption." 

The comptroller’s office had worked to catch up just before the ransomware attack, and had prepared a run of about 50 to 60 past-due tax claims to be paid that were “banged together and were ready to send to the audit staff in Hauppauge on Sept. 6 — then the shutdown occurs and that’s it, the ability to move the stuff electronically ceases,” Kennedy said. Some 200 past-due refund checks could be processed in the next week. Kennedy noted he'd only gotten full access to his financial management system earlier this month. 

Issues with the financial management system are behind a resolution offered in the Suffolk Legislature that seeks to give Kennedy the authority to shift the system to the cloud rather than county servers. 

The resolution, introduced by Legis. Robert Trotta (R-Fort Salonga), discusses the “severe financial strains” put on county vendors tied to late payments after most had to be handled manually following the cyberattack. The appropriation for the transition to the cloud is expected to cost under $1 million, said the source familiar with the system.

Kennedy had been prepared to speak on this issue Wednesday but the resolution was tabled for a later date because of legal issues tied to which officials have waiver authority during a state of emergency.

As Newsday reported, the software system vendor, CGI, conducted a review of the attack and found issues with the county’s preparedness and response to the attack, including the lack of a continuity plan for the financial system and the potential for conflicts among county agencies because there are “no dedicated security professionals with the appropriate level of responsibility and accountability.”

Suffolk County Executive Steve Bellone’s administration has included appointment of a chief information security officer in the 2023 county budget after years of recommendations to do so.

Kennedy said regular computer system tax-refund payments could start this week. He’s been working to conduct regular Monday operating runs to remit a full range of payments for all county vendors that are normally weekly but acknowledged, “They are not at the same volume that they previously had been.

“Simple math will tell you that if you go eight weeks without doing that run, you will incur roughly $200 million of [backlog] activity,” Kennedy said of the county’s overall past due payments.

Suffolk spokeswoman Marykate Guilfoyle said the county is reviewing a migration of the financial management system to the cloud, saying the county overall is “supportive of cloud-based systems.”

“Before we migrate a fully functional, cleared and secure system to the cloud, we must first restore all outstanding critical systems,” she said in a statement. “The process will then include a re-architecting of systems to be built with purpose.”

By Mark Harrington

mark.harrington@newsday.comMHarringtonNews

Mark Harrington, a Newsday reporter since 1999, covers energy, wineries, Indian affairs and fisheries.