Ransomware Attack on Suffolk County Affecting Deeds, Titles, Mortgages

The cyber intrusion into Suffolk County’s networks uncovered on September 8 halted title searches and deed recordings for home sales and transfers, affecting mortgages, title insurance and closings — and it is unknown when county services will get back to normal.

On Monday, the county clerk’s office announced that county computers will be accessible for title searches in person at the county center in Hauppauge, but remote searches are still unavailable. Deed recordings remain on pause as the county continues to deal with the fallout of the intrusion and ransomware attack, and the longer the delay, the greater consequences the real estate industry will face.

Suffolk County detected the intrusion on September 8 and announced five days later that county systems were taken offline and services disabled as the source was investigated.

DataBreaches.net, a blog about data leaks and breaches, reported on September 16 that the ransomware group known as “ALPHV” or “BlackCat,” via a dark web leak site, took responsibility for the Suffolk County attack and published a few internal county documents to prove it.

“The total volume of extracted files exceeds 4TB,” BlackCat wrote.

The repercussions of the ransomware attack are far reaching, and the real estate industry is particularly affected due to the county’s role in tracking deed transfers, mortgages and liens. Homes can still be marketed, and buyers and sellers can still strike deals, so real estate agents can go about their business, but lenders, mortgage brokers, title search agencies and title insurance companies are all experiencing the impact.

“It has affected us significantly,” said mortgage loan officer Bill Wright of Par East Mortgage Company, which has offices in Southampton and East Hampton. “There’s been some refis and purchases that were put on hold because they weren’t able to do the title search.”

The title report shows any liens or judgments against the buyer, any liens against the property and any open building permits, he explained, adding, “You can’t do a real estate transaction without an updated title report.”

The county announced Friday that it had set up 120 terminals for title examiners to come in person and run title reports starting this past Monday. However, Wright said only a couple of printers are available to the examiners.

“They actually just sent an email out saying that the county is back up and running, but they’re really not,” he said.

Wright said Par East is still doing mortgages but with no idea when the title reports will come in.

“It has definitely been a challenge across the industry since the county’s alleged cyber attack,” said Chris Nuzzi, the executive vice president and regional director for Advantage Title on the East End. “If you think about the spin-off effect of the real estate economy throughout Suffolk County, it literally amounts to billions of dollars of transactions that, some of which, for at least a period of time, were on hold. And that could be anything from the major development going on in western Suffolk to the some of the high end residential out in eastern Suffolk County, and then everything in between, right all the way down to people who are purchasing a first home, we’re doing a refinance and potentially in jeopardy of losing their rate lock.”

Nuzzi credited the county clerk’s office and the county in general for getting title searches up and running again.

“They’ve recognized that economically, for everyone in Suffolk County, there has to be some sort of interim approach and solution to get their systems back online,” he said.

He said on Monday that although the access for title examiners is strictly internal, there is some return to normalcy.

“We should theoretically be able to produce a title report,” he said. “The county, I’m sure is going to have to play catchup on recordings of certain documents — be they deeds, mortgages, other liens on properties — so there’ll be a gap period. But with that internal access back up and restored, we can at least go and do a title search.”

He described the interim system as similar to how title searches operated prior to the COVID pandemic.

When the pandemic started, remote access to the county’s records became widely available.

“It’s not without its obstacles as the county comes back up to speed and gets caught up on other recordings and other documents that have been sitting now for the better part of several weeks,” Nuzzi said, “but I know they’ve been working on that and will continue to.”

The title industry has been facilitating closings since the county’s web shutdown, according to Nuzzi.

“We’ve just had to be creative and deliberative in how we’ve done that,” he said, though he added that it became more difficult as each day went on without access to county records and it would have inevitably become impossible to put together title reports for new transactions.

Lucas Rodriguez, an account executive and staff closer at First International Title in Riverhead, said the lack of remote access will be very difficult.

“If the county doesn’t go back to the way things were before the ransomware attack, it’s going to up-end real estate out here,” he said. “… If that remote access stays down for a significant period of time, it’ll put us back in the Dark Ages, basically.”

He questioned whether remote access would ever be restored and was also concerned about how much catching up there is to do.

“Remember, now there’s going to be a backlog for everything you couldn’t do in the past month,” he said. “You know, there’s that pile, so you got to get through that pile, and then the new stuff that you have. It’s not reassuring.”

He said the underwriters for the title insurance companies that take on the risk have been closing certain deals, but not all deals.

“If it’s not a completely clean file, it’s really not closing,” Rodriguez said. “But what lenders and underwriters have been doing is having the sellers sign an additional affidavit at closing.”

In the affidavits, the sellers attest that they haven’t taken out any other mortgages, haven’t sold the property to anyone else and haven’t encumbered the property in any way, he explained.

Typically, title examiners call the county one last time on closing day to make sure everything is exactly the same, he said — but that couldn’t happen while the county services were shut down.

“You want to make sure nothing changed,” he said. “The inability to do that second search has forced the underwriters to take a lot more risk. So to be honest, I’m kind of surprised that they’re closing.”

The attack happened at the best possible time, according to Rodriguez, because real estate sales were slow anyway.

“The industry is very, very slow right now, but it hasn’t prevented buyers and sellers from listing and going into contract,” he said. “It just puts a significant delay on everything. That’s all.”