An April 17, 2024, cyberattack interrupted New York’s legislative bill-drafting systems and required an older workflow. The commission reported affected personal information involving 730 people and continuing system restoration in May; Play’s responsibility remains unconfirmed.
Unauthorized access to systems, accounts, networks, or data.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A specific application or software platform became unavailable or unusable.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
A cyberattack interrupted the New York Legislative Bill Drafting Commission’s systems early April 17, 2024. The commission prepares and prints legislation for lawmakers in Albany. Gov. Kathy Hochul’s same-day account described staff continuing through an older system while state cybersecurity personnel responded.
The commission’s report to the attorney general, submitted May 8, documented unauthorized access and affected personal information. It listed 730 affected individuals, including 710 New York residents. These figures are people affected by the breach, not a count of commission employees.
The interruption forced a fallback workflow during completion of an already overdue state budget. Contemporary reporting quoted Senate spokesman Mike Murphy saying the office could still process work and that he did not expect an overall delay. The attack’s effect on drafting should be distinguished from the budget’s preexisting lateness.
The May 8 filing said recovery continued, with some systems being restored and others entirely rebuilt. The filing’s April 17 breach-end entry describes the reported breach span, rather than the end of operational disruption.
In August reporting, the Office of Information Technology Services said its response efforts had been completed and the attack contained. That statement supports closure of its response role, while the public record does not establish the exact date every commission system returned to normal.
Confidence in cyber involvement, service disruption and unauthorized access to personal information is high. The official filing identifies Social Security numbers, driver’s license or other identification numbers, and financial-account information including payment cards. It does not specify how many individuals had each category affected or distinguish all information viewed from information copied.
Play’s claim reported in April remains separate from those official findings. The group alleged theft of multiple kinds of records, but the commission did not publicly confirm its responsibility. The indexed listing was discovered April 26; that is not its verified original publication date.
The initial access route, precise restoration date, extent of copied information and any ransom demand or payment remain unresolved. The filing records April 25 notifications and May 1 discovery that private information had been accessed or acquired; it does not explain that ordering. The later reporting does not establish that legislative text was altered.
Play’s listing, indexed April 26, 2024, names the Legislative Bill Drafting Commission and historical lbdc.state.ny.us domain. Comparitech reported the group’s allegation of stolen personal and administrative records on April 29. The commission’s later official breach filing documents affected personal information but does not confirm Play’s responsibility, encryption, a ransom amount or the complete copied-data scope. Tracker discovery is not original publication.
The commission’s offices are in the New York State Capitol in Albany. The attack disrupted its bill-drafting and printing systems.
The commission supports New York’s state Legislature. The governor said the attack affected its bill-drafting system while lawmakers were working on the state budget.
The Associated Press reported disrupted bill-drafting operations and continued work using an older system while state officials responded.
The governor acknowledged the predawn attack and use of an older bill-drafting system.
Officials described disrupted bill drafting and an older processing workflow; a Senate spokesman said he did not expect the attack to delay the overall budget.
Play alleged stolen personal and administrative data; the state had not confirmed the group’s responsibility.
Reporting provides the underlying incident filing and a state response about containment.
The indexed listing names the Legislative Bill Drafting Commission as an alleged Play victim.
The commission reported 730 affected individuals, personal-information access and ongoing system recovery.
Signed-in members can report an error, update, or missing source.
