Hackers hijacked data - and a program that gets sick and elderly to their doctors

Katherine Abernathy waited and waited at her house early Wednesday morning.

The ride she needed to a doctor’s appointment was running late – or so she thought.

When the 66-year-old Charlotte woman called Mecklenburg County Department of Social Services – the agency that organizes medical transportation for the sick, the poor and the elderly – Abernathy learned there was no record of her scheduled trip.

“No one had me on the books,” she said.

It was a shock for Abernathy, who says the office normally is well-organized and efficient.

But Abernathy and hundreds of other people who use DSS’ transportation service were affected this week when cyber criminals forced their way into Mecklenburg County government’s extensive network of computers and hijacked data servers that underpin critical public services. Officials say the culprit is suspected of being a foreign-based hacker but that it was a random attack, not a targeted effort.

Although the cyber attack is still under investigation, officials said they believe trouble started when an employee mistakenly clicked on a malicious phishing email and attachment, opening the digital door to widespread disruption across government offices from the tax assessor’s office to human resources.

In some cases, entire data servers went dark.

Work slowed to a crawl in some departments as government employees were forced to do business by phone only or in person and staff couldn’t access computer files or electronic records. Job applications were frozen, a hotline for domestic violence victims was temporarily not working, and the sheriff’s office resorted to booking and releasing jail inmates via paperwork and manual process.

County leaders said on Wednesday they anticipate it will take days before most damage is fixed and systems are fully-operational again. Even as outside experts and computer security teams were working around-the-clock on the issue, county leaders reported on Thursday they’d intercepted a second wave of hacking attempts. By Friday, officials said progress was made on making repairs but that some services were still inaccessible.

At DSS, the hacking incident disrupted the agency’s transportation scheduling software, making coordination of rides more difficult for people going to see doctors, pick up prescriptions or shop at the grocery store.

The ordeal made Abernathy almost 45 minutes late on Wednesday to her appointment at a Novant Health clinic where she takes physical therapy a few days a week to help her heart and lungs. Her doctor, she said, allowed her to keep her appointment despite being late.

Abernathy is a diabetic, has a pacemaker and she sometimes has difficulty walking. She anticipates needing a hip replacement soon and is scheduled to have cataract surgery on her right eye next week.

She needs regular physical therapy sessions for improving her health and she needs DSS’ help to get to and from her appointments. She worries about other people who may not have made their appointments because of the cyber attack.

On average, DSS schedules nearly 1,600 rides like this a day.

Many people who use DSS’ transportation service are vulnerable and need the assistance to get to life-saving treatments like chemotherapy sessions and dialysis, officials said.

People who have transportation needs coming up next week should call DSS’ Care Line (704-336-4547) to ensure service. Any rides using the “on-demand” service need to be re-confirmed until the department’s computer issues are resolved, officials said. People who use subscription-based services do not need to confirm the transportation.

DSS is using an all-hands approach to ensure people are served, despite the hacking incident, said Lawrence Corley, a county spokesperson.

“We have additional staff answering calls and drivers are doing whatever is needed to get customers to their appointments,” he said. “Doctors’ offices and other medical service providers have been very helpful in assuring that DSS knows of appointments and accommodating and/or rescheduling as needed.”

Abernathy says she appreciates the people at DSS who have worked hard to overcome the hacking incident.

“They bent over backward to get me there. I was late and my blood pressure was a little high when I was there but they did get me there,” she said.

DSS’ Mecklenburg Transportation Service primarily helps people get to medical appointments but can also serve elderly people who need to visit the pharmacy, recreation centers or the grocery store. The program subsidizes taxi rides for many adults using the service. The fee is a flat rate of $1.50 for transportation one-way anywhere in the county.

Other programs administered by DSS locally include a Medicaid-funded bus pass, transportation for people with disabilities, help for poor families with children, and hospital and clinic transportation for military veterans.

“It has been a godsend for me,” Abernathy said.

On average, she uses the service four times a week. Without it, she said, she would likely not go to doctors appointments as often and her health would suffer.

The unidentified person or people responsible for the cyber attack on Mecklenburg County demanded $23,000 in exchange for restoring data. The county rejected the demand for money on Wednesday, with County Manager Dena Diorio saying the payment would not necessarily speed up recovery time and that most affected data was safely backed-up and could be recovered without making the ransom payment.

This story was originally published December 8, 2017 at 4:33 PM with the headline "Hackers hijacked data - and a program that gets sick and elderly to their doctors."