Ransomware attack affecting Suffolk County in big ways and small

Since September, each time Heidi Velovic has contacted Suffolk County’s Health Department for paperwork to start her son in early-intervention programs to treat his mild autism, unwillingness to eat and delayed speech, she said, the excuse has been the same.

“They say, 'You know we've been cyber-hacked, right?'” Velovic of North Amityville said Monday, five days after therapy was originally scheduled to start for the boy, who turns 3 in February and reaches the maximum age for the early intervention program. “That’s their excuse every single time.”

Even an outside coordinator assigned to her case, she said, has been hobbled “because she can’t get paperwork from the Suffolk Department of Health.”

Nearly two months after Suffolk County was hit by a devastating ransomware attack, systems and services big and small, and the residents and businesses that rely on them, continue to be impacted.

The Sept. 8 attack affected police communications, delayed more than $140 million in county payments, and forced the county to resort to paper records and in-person payments, applications and evaluations across a range of departments. Suffolk has been gradually returning services on a "rolling" basis, but has been relatively quiet on the extent of the damage or a definitive timeline for its return.

On Wednesday, after Newsday contacted the county about Velovic's case, a supervisor reached out and told her that her son's paperwork "would be filed right away." Marykate Guilfoyle, a Suffolk spokeswoman, blamed the delay in Velovic's case on "a lack of available providers," and not the cyberattack.

Velovic is far from alone in her frustration. Continuing impacts are available across county services. At Suffolk's Traffic and Parking Violations agency in Hauppauge, tickets still can’t be paid in person. And restaurant owners such as Dennis O’Leary are confronting new delays and costs for training and certificates for himself and his staff.

O’Leary owns the Maple Tree BBQ Smokehouse in Riverhead, where managers are required by the Health Department to get certified in food safety every three years.

Training classes for the certification “used be handled though a phone app,” O’Leary said. “It’s a wonderful tool.”

But with the county website largely down since September, he said, employees now must schedule three days’ worth of classes on site at a county location, or worse, through a more expensive outside provider. “Now I have to pay to have people take three days of classes,” O’Leary said. “You can’t even pay them by credit card. I think I had to give them a check.”

Elsewhere applications for professional licenses through the Department of Labor, Licensing and Consumer Affairs must be mailed or delivered in person. The county’s TransLocRider App, which was rolled out in 2017 and allows bus riders to see where their bus is in real time, is not functioning. And officials with the county Board of Elections are looking for a solution to post results on Election Night Tuesday as the department’s county-hosted website is down.

County officials have not offered a timeline for when those services could be restored.

While O'Leary's beef with the county is “relatively minor compared to what others are suffering,” he said, he’s been particularly frustrated by the lack of guidance and disclosure coming from the county. “It’s the weirdest thing,” he said. “There’s just no information.”

Suffolk County’s modified website tells customers about the attack and how to protect personal data if it’s been compromised, but goes on to list sharply abbreviated descriptions of county government, with some contacts and service updates.

Among them is the Traffic Violations and Parking Agency, which adjudicates traffic and parking tickets. As of Nov. 1 it was still unable to process tickets on site, officials said.

“Everything’s on hold right now,” said office clerk Samantha Smith.

People who are appealing suspension of their driver’s license are particularly hard hit, several lawyers said.

“If you can’t go pay off the ticket, you can’t clear up the suspension,” said attorney John Powers of West Islip. That creates a problem because “they remain in limbo until we don’t know when,” said Deer Park attorney Kevin Cadden.

Scott Lockwood, a lawyer based in Deer Park, said some people have received letters from the agency saying that they’re not scheduling any cases until 2023. When a reporter visited the SCTVPA in Hauppauge recently, only a handful of people were in the normally busy building.

Paul Margiotta, SCTVPA executive director, declined to be interviewed.

Tickets cannot be paid in person at the agency, said Guilfoyle. However, people with tickets can go to the agency and get a time-stamped receipt to avoid late fees. Some tickets can be paid online.

Meanwhile, thousands of Suffolk vendors say the county is late in paying them for their services.

Suffolk County Comptroller John Kennedy said his office has regained limited access to its financial management system and is migrating to a cloud-based system. Other services, such as access to the delinquent tax payment website paymysuffolktaxes.com, have resumed as well.

“Every vendor with a valid and legitimate claim in Suffolk County is going to get paid,” Kennedy said. Operations with a dire need for payment should contact the department that handles their contract, he said.

Those visiting inmates at the Suffolk County jails in Yaphank and Riverhead now must make an appointment ahead of time to allow staff time to run a background check. Directions for making an appointment are available on the sheriff’s office website.

The sheriff’s office is also not processing new applications for pistol licenses, although amendments can be made to existing permits,   spokeswoman Vicki DiStefano said.