New York was struggling toward a budget deal. Then hackers made it worse.

ALBANY, New York — Lawmakers at the state Capitol, 17 days late delivering a state budget, were finally hoping to wrap up the process this week. Then the weird emails started to arrive.

At least one state legislative office received a message — purporting to be from the commission charged with drafting the budget language — with a bill document written in a Cyrillic language.

It was a sign of a bigger problem: It was likely sent, officials assumed, by the same people who had launched a cyberattack on the commission’s computers and are now demanding a ransom.

The incident left the state budget deal in limbo and raised new questions about states’ ability to protect its critical digital infrastructure.

The problem was so befuddling that Gov. Kathy Hochul said the state commission had to turn to a computer system from 1994 so it can continue work as the state Legislature and the Democratic governor try to finalize the $237 billion spending plan.

One state official familiar with the details of the attack, and granted anonymity because of the ongoing investigation, said no specific dollar amount was being sought by the attackers at the moment. A ransomware attack occurs when a perpetrator blocks access to a system until a specific amount of money is paid.

“We’ve been more concerned about finding the source, finding how we can remedy this, how we can get back to normal so it’s something we’ve been dealing with since the wee hours of the morning,” Hochul said in a radio interview on WNYC.

The incident is another reminder of how federal and state governments, private entities and other municipalities continue to be at heightened awareness for cyberattacks and struggle to find ways to thwart them. In New York alone, attacks on critical online infrastructure rose by 53 percent between 2016 and 2022, a report last year by the state Comptroller’s Office found.

Hochul and top legislative leaders insisted the attack would not hinder budget negotiations, but all lawmakers wanted to talk about the newest twist thwarting a final deal — joking about how the Russians are attacking, but also offering a dose of reality that it might keep them in Albany longer.

“I think on the light side, it’s mildly entertaining at such a tense period in our budget negotiations,” state Sen. Jessica Ramos, a Queens Democrat, said. “And at worst, it can cause a delay to make me late to pick up my kids from school – so I don’t appreciate that.”

Lawmakers wrapped up their regular legislative sessions without any immediate plan on how to proceed as the threat was still being investigated.

Senate Finance Committee chair Liz Krueger, a Manhattan Democrat, said she was told it was a ransomware attack.

“The implication was it was a hacking type of thing. I don’t know if someone sent us a bill,” she told POLITICO.

The state Division of Homeland Security and Emergency Services was involved in reviewing the incident. The office declined to comment on an ongoing investigation.

Hochul in the radio interview said “it will take a little bit longer to deal with the legislative side of” passing the budget due to the attack. But she promised there are workarounds.

Her office said it would not comment further, citing the investigation.

The 1994 system was what the Legislature used for most of its time before cyberspace. It was replaced by a system that was created after Democrats assumed the majority in the state Senate in 2019.

The old system “was very antiquated,” said a person familiar with the Legislature’s technological infrastructure. “For something that important, you shouldn’t use 30-year-old technology.”

For now, the return to the old system seems to be working. The state’s legislative tracking service was updated throughout the day to include new resolutions that had been introduced and account bills that passed the Senate.

New York last dealt with a widespread cyberattack in January 2020 when multiple state agencies, including the Department of Motor Vehicles, were targeted.

With the state budget already 17 days late, lawmakers are hoping the attack will not cause further delay in passing a spending plan.

"It's a bit of Murphy's Law, where you think everything that could go wrong has already gone wrong and then this happens,” Buffalo Sen. Sean Ryan told POLITICO. “Hopefully it’s a temporary glitch.”