The New York state Capitol against a wall of code

Republish this article

Hackers Nabbed State Employees’ Credit Card and Social Security Numbers

Story and multimedia republishing rules

All our stories are published under Creative Commons, meaning that you are free to copy and distribute in your publication.
You may edit material to reflect relative changes in time, location and in-house style (for example, changing “yesterday” to “last week.”) If you’d like to make more substantive edits, like condensing stories, please run them by alex@nysfocus.com before publishing.
Bylines should credit New York Focus, in this format: “By [name of reporter], New York Focus”
Include the following language at the top of the story, with a link to our newsletter:

This story originally appeared in New York Focus, a nonprofit news publication investigating power in New York. Sign up for their newsletter here.

Please link back to our original story in the attribution line as well and include all hyperlinks from the original piece in the republished version.
If you share the story on social media, please mention @nysfocus (Twitter/X, Bluesky, Threads, Facebook, Instagram, TikTok).
Don’t sell the story or any part of it — it may not be marketed as a product.
Don’t extract, store or resell New York Focus content as a database.
Don’t sell ads against the story. But you can publish it with pre-sold ads.
Your website must include a prominent way to contact you.
You must obtain permission to package additional elements with our story and must label them.
You can republish our photos, illustrations, graphics and multimedia elements, but only with stories with which they originally appeared. You may not separate multimedia elements for standalone use. If you’re having trouble accessing visual elements, let us know.
If we send you a request to change or remove New York Focus content from your site, you must do so immediately.

For questions regarding the New York Focus publishing rules, or if you are a journalist or news organization that wants to join our partner list, please contact Alex Arriaga, Audience Engagement Editor, at alex@nysfocus.com.

This story originally appeared in <a href="https://nysfocus.com/2024/08/06/cyberattack-hack-legislature">New York Focus</a>, a nonprofit news publication investigating power in New York. <a href="https://nysfocus.com/newsletter?utm_source=partner&utm_medium=website" target="_blank">Sign up for their newsletter here</a>.<hr>NEW YORK STATE · August 6, 2024
<h1>Hackers Nabbed State Employees' Credit Card and Social Security Numbers</h1>
<h2>It’s unclear whether the legislature is taking steps to address its security vulnerabilities.</h2>
<h3>By <a class="yellow-underline" href="https://nysfocus.com/author/sam-mellins">Sam Mellins</a> , New York Focus</h3><figure><img src="https://imgproxy.gridwork.co/He_C7sCvu8nc9r9mWPKN5w5go8PKJMN05oDkiYuii8k/w:820/h:461/rt:fill/g:fp:0.5:0.5/q:90/el:1/aHR0cHM6Ly9zMy51cy1lYXN0LTIuYW1hem9uYXdzLmNvbS9ueXNmb2N1cy9VbnRpdGxlZC1kZXNpZ24tMTguanBn.jpg" alt="The New York state Capitol against a wall of code" /><figcaption>As legislative leaders remain silent, key questions about an April cyberattack still have no answers. / Illustration: Akash Mehta</figcaption></figure>	An April cyberattack targeting the New York state legislature led to hackers obtaining the sensitive financial information of as many as 710 New Yorkers, according to an incident report obtained by New York Focus through a public records request. It’s unclear whether the legislature is taking any steps to address the security flaws that led to the hackers gaining access.
The attack targeted the Legislative Bill Drafting Commission, an office within the legislative branch that writes up the bills proposed by lawmakers. <a href="https://ny1.com/nyc/all-boroughs/news/2024/04/17/new-york-state-legislature-hit-by-apparent-cyberattack">The hack</a>, which was widely <a href="https://www.politico.com/news/2024/04/17/cyberattack-new-york-budget-00152885">reported</a> on <a href="https://nypost.com/2024/04/17/us-news/capitol-printer-hacked-throwing-wrench-into-state-budget-passage/">at the time</a>, derailed the bill drafting process and forced the commission’s staff to temporarily revert to an antiquated 1994 computer system as they finalized the state budget, according to Governor Kathy Hochul.
The hackers gaining access to sensitive financial information has not been previously reported.
On the day of the hack, April 17, government officials said they had been told it appeared to be a ransomware attack, a strategy in which hackers block access to certain data until the target pays a sum of money. The hackers, whose identity and methods remain publicly unknown, obtained driver’s license numbers, credit card information, and Social Security numbers, according to the incident report. 	<hr>
	Do you work at the Legislative Bill Drafting Commission? We'd love to hear from you about the April cyberattack. Please reach out to <a href="mailto:sam@nysfocus.com">sam@nysfocus.com</a>. Your information will not be published without your permission.
	<hr>
	The report states that the attack affected 730 individuals, including 710 New York residents. It does not specify how many of those individuals had specific kinds of information compromised.
The hackers may be able to use the information they obtained to attempt identity theft, according to Douglas Jones, emeritus professor of computer science at the University of Iowa.
“This might be enough to open bank accounts, take out loans, and make credit card purchases in the victim’s name,” Jones said.
Legislative leaders have refused to provide any further details about the attack or how they responded to it. The head of the Legislative Bill Drafting Commission, Christopher Higgins, declined to answer questions, instead referring them to Senate Democrats’ communications director, Michael Murphy, who did not respond to multiple requests for comment. Assembly Speaker Carl Heastie’s spokesperson Michael Whyland also did not respond to requests. 
When confidential data is hacked, state entities are <a href="https://www.nysenate.gov/legislation/laws/STT/208">legally required</a> to inform the Office of Information Technology Services, the state agency responsible for cybersecurity, which is then required to conduct an investigation. But while ITS helped get the computer system back online, there is no indication that the legislature communicated news of the stolen financial data, and the agency has not conducted an investigation into the incident. 			<iframe
 src="https://embed.documentcloud.org/documents/25029926-lbdc-hack/?embed=1&responsive=1&title=1"
 title="LBDC hack (Hosted by DocumentCloud)"
 width="700"
 height="905"
 style="border: 1px solid #aaa; width: 100%; height: 800px; height: calc(100vh - 100px);"
 sandbox="allow-scripts allow-same-origin allow-popups allow-forms allow-popups-to-escape-sandbox"
></iframe>
		
	“Once the response efforts were completed, the attack contained, and the Budget was successfully delivered, we considered our job to be done,” said Scott Reif, who heads communications for ITS.
“We have not been subsequently informed by the LBDC that specific legal requirements had been met that would trigger additional actions by ITS or any other Executive agencies,” he added.
In April, Hochul <a href="https://www.wnyc.org/story/gov-hochuls-take-budget-deal">promised</a> that her administration would investigate the attack and share the results with the public. That hasn’t happened, possibly because she <a href="https://www.nysenate.gov/legislation/laws/STT/208">may not have the authority</a> to conduct an investigation without the legislature’s invitation.
“I have one of the top cybersecurity teams in the entire country. I knew that was a priority. No one will do it better than we do in trying to get to the bottom of this attack,” Hochul said during an interview on WNYC’s The Brian Lehrer Show. “We’ll let people know what we know when we know it.”
It’s unclear whether the legislature has mounted its own investigation.	As legislative leaders remain silent, key questions about the breach still have no answers.
One is whom the attack affected. Fewer than 500 people work for the Bill Drafting Commission, meaning the scope of the attack, which affected 730 people, extended beyond its staff.
Another is whether the attackers made changes to the text of laws or bills, two security experts said. The incident report said that the hackers obtained other nonfinancial information, but did not specify what.
“Any reasonable cybersecurity office would check that the data has not been tampered with,” said Susan Landau, a computer science professor at Tufts University and an expert on cybersecurity. “A minor change could have big implications.”
State agencies <a href="https://www.nytimes.com/2021/06/02/nyregion/mta-cyber-attack.html">have been hacked</a> several <a href="https://www.timesunion.com/news/article/Just-before-pandemic-New-York-State-government-15197960.php">other times</a> in <a href="https://ethics.ny.gov/news/jcope-update-cyber-security-incident">recent years</a>, though there’s no evidence financial information was compromised in those cases, and two of the targeted agencies specifically said at the time that hadn’t happened. 	The lack of investigation raises questions about the state’s strategy to prevent cyberattacks, said Albert Fox Cahn, founder and director of the Surveillance Technology Oversight Project, a New York-based digital privacy advocacy group.
“We need to understand how the state is investing to prevent this from happening again,” Cahn said. “If you don’t study what went wrong, you’re going to have a much harder time preventing it.”
Last year, Hochul added $35 million to the state’s cybersecurity budget and released a statewide cybersecurity strategy. But the executive branch doesn’t have the authority to set rules for the legislature.
The hack was likely exacerbated by using out-of-date security practices. The fact that hackers both rendered the bill drafting system unusable and were able to access Social Security numbers and financial information indicates that the same system was being used for bill drafting as for payroll — an obvious no-no, said Jones, the Iowa professor.
“You don’t want a careless staffer to open a work-related email and have it clobber the payroll system,” he said. “This kind of separation has been common for 50 years in the corporate world.”
In addition, if the commission was forced to revert to its 1994 computer system, that suggests that it lacked an updated backup version, Landau said.
The attack should serve as a wake-up call to state government, Cahn said.
“This crippled incredibly important infrastructure, and on top of that, it exposed all this confidential information,” he said. “To me it’s very odd that you’re not seeing an expanded response.”	 
<script src="https://nysfocus.com/pixel.js" id="republish" data-origin-url="https://nysfocus.com/2024/08/06/cyberattack-hack-legislature"></script>