‘BlackCat’ group claims responsibility for ransomware attack on Suffolk County, begins publishing stolen documents on dark web

A team of cybercriminals is claiming responsibility for the ransomware attack on Suffolk County’s IT systems.

Suffolk County Executive Steve Bellone tonight confirmed that “(i)nformation posted yesterday on the dark web indicates a threat actor has claimed responsibility for the current cyber incident in Suffolk County.”

According to DataBreaches.net, a website that monitors and published information about data breaches, a group know as “ALPHV” or “BlackCat,” posted information on its dark web leak site yesterday stating it had encrypted more than 4 TB of data from county government systems and those of government contractors.

“Due to the fact that Suffolk County Government and the aforementioned companies are not communicating with us, we are publishing sample documents extracted from the government and contractor network,” the group posted, according to the DataBreaches website.

“Extracted files include Suffolk County Court records, sheriff’s office records, contracts with the State of New York and other personal data of Suffolk County citizens. We also have huge databases of Suffolk County citizens extracted from the clerk.county.suf. domain in the county administration.” The group posted some documents to its site, and promised to publish more unless their demands are met. Databreaches.net published redacted screen captures of documents published by “Black Cat.”

Bellone said in a statement tonight the the county’s incident response team is assessing this information and working closely with law enforcement agencies. 

“The County’s Information Technology Department has spearheaded an enterprise-wide effort to evaluate the impact of this cyber-incident to proceed with the safe and secure restoration of servers,” Bellone said.

Suffolk County websites, email and IT systems have been offline since Sept. 8 in response to the attack.

He said the “ongoing system integrity evaluation so far indicates that the network infrastructure is intact.” 

County agencies have enacted contingency plans and have been providing services through other redundant means and methods, Bellone said. “The essential work of county government continues.”