Subscribe to receive Urgent Communications Newsletters
Catch up on the latest tech, media, and telecoms news from across the critical communications community
Suffolk County ransomware attack linked to lack of planning, ignored warnings
David Jones / Cybersecurity Dive
September 19, 2024
1 Min Read
A special legislative committee in Suffolk County, New York, found officials ignored repeated warnings and failed to prepare ahead of a September 2022 ransomware attack that disrupted essential government services for months, in a report released last week.
Officials blamed the ransomware attack on a failure of leadership, including the lack of an incident response plan and a failure to respond to FBI warnings of potential infiltration.
Suffolk County operated using a variety of IT teams and had no CISO, resulting in a lack of coordination on how to prepare for potential cyber threats. The attack has so far cost the county more than $25 million in remediation costs and other expenses.
Dive Insight:
The report illustrates the potential risks facing municipal governments across the U.S., which are often facing inadequate budget allocation, personnel shortages, aging technology and other resource constraints. Legislative officials said the county failed to communicate numerous problems with their IT systems dating back for years.
A pass-through was created that allowed data traffic to move through firewalls connected to the Suffolk County Clerk’s office, according to the report. Numerous firewalls had reached end-of-life status and were no longer receiving security upgrades.
“We learned now that we did not get information dating back to 2017 showing that our IT systems were really under critical threat,” said Suffolk County Legislator Anthony Piccirillo, who led the committee investigating the attack.
To read the complete article, visit Cybersecurity Dive.
