Incident BriefingsSuffolk County, NY security incident

Suffolk County, NY security incident

Suffolk County determined on September 8, 2022 that its systems appeared to have been affected by a cyberattack. Threat actors accessed or acquired personal information from county servers, including some driver license and passport numbers held by the Traffic and Parking Violations Agency.

Last modified

Summary

  • Environment: Government (county)
  • Operational impact: Threat actors accessed or acquired personal information from county servers, including some driver license and passport numbers held by the Traffic and Parking Violations Agency.
  • Financial impact: No financial figure is established by the reviewed source evidence
  • Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.

What happened

In 2022, Suffolk County, NY experienced an incident in its government (county) environment. The retained source describes the attack path as follows: Suffolk County determined on September 8, 2022 that its systems appeared to have been affected by a cyberattack. [1]

The documented consequence was: Threat actors accessed or acquired personal information from county servers, including some driver license and passport numbers held by the Traffic and Parking Violations Agency. [1]

Impact

  • Documented impact: Threat actors accessed or acquired personal information from county servers, including some driver license and passport numbers held by the Traffic and Parking Violations Agency. [1]
  • No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.

Timeline

  1. Documented public update

    The Identity Protection Service records the incident facts used in this briefing.

    [1]

  2. Briefing updated

    This briefing was last reviewed and updated on September 19, 2026.

Threat Group & Attack Vector

The retained source describes the attack path as follows: Suffolk County determined on September 8, 2022 that its systems appeared to have been affected by a cyberattack. The canonical record does not add intrusion steps beyond those supported by the source. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

The county hired cybersecurity firms, worked to restore online services, and offered 12 months of identity monitoring to specified affected groups. [1]

This account is bounded to Identity Protection Service. Details absent from that evidence are left unresolved rather than inferred. [1]