Skip Ribbon Commands
Skip to main content
...

​Ransomware Incident Update

1/3/2018

computerJan. 3, 2018

Eleven new systems are now working, including the ability to apply for jobs online.  View County job openings.

Friday, Dec. 22

It’s been less than a month since Mecklenburg County’s online systems and applications were compromised in a ransomware attack that left many services frozen. Now, the County is pleased to report that more than 80 internal and public-facing online systems and services have been restored and are operational.
Among the services restored are:


  • Online payment service has been restored for gross receipts taxes. Both property taxes and gross receipts taxes can be paid online by visiting www.MeckNC.gov/paytax instead of mailing or paying in person.
  •  Public Web Access to the property tax system has been restored. This allows the public to view tax bills without calling for assistance. The public is encouraged to visit www.MeckNC.gov/taxes and use the Property Tax System link instead of calling in.
  • Code Enforcement’s Electronic Plan Management System and WebPermit/Outrider, which includes the contractor's dashboard, Homeowner Internet Permitting and Trade Internet Permitting are working.
  • Polaris and other critical GIS applications are operational.
  • Park and Rec’s online registration and reservation system is working.
  • The Charlotte Mecklenburg Library reports its systems are up.
  • Real Estate Lookup which links to tax assessment information has been restored. This allows the public to view tax appraisal data without calling for assistance. The public is encouraged to visit www.MeckNC.gov/taxes and use the Real Estate Lookup link instead of calling in.
     


Customers are reminded that the attack does not affect the state mandated Jan. 5, 2018 deadline for payment of personal property and real estate taxes.

Multiple other systems are still being tested and should be restored soon.

Thursday, Dec. 21

A number of key applications and systems from Code Enforcement and Tax Collections are among the latest to be restored as the County continues to recover from the Dec. 5 ransomware incident. In addition, the Charlotte Mecklenburg Library reports that all of its systems have been restored.

Here’s the latest:

Code Enforcement

  • Electronic Plan Management (EPM).
  • WebPermit/Outrider, including the contractor's dashboard, Homeowner Internet Permitting (HIP) and Trade Internet Permitting (TIP).

 

Please note: Not all of Code’s supporting systems are fully functional yet. Please log in and try to work normally. If you encounter error messages or other difficulty, please call the Customer Service Center at 980-314-CODE.


Office of the Tax Collector

  • The property tax system is operational, including the online payment service (MeckNC.gov/paytax).
  •  The gross receipts tax system is operational for payment processing, but the online payment service is not available at this time.

 

For assistance, contact the Office of the Tax Collector at 704-336-7600.

GIS

  • Polaris

 

Multiple other systems are still being tested and should be restored soon.

Wednesday, Dec. 20

As Mecklenburg County works to resolve the ransomware attack that froze many online services, County employees continue to find ways to conduct business and serve customers. 

Many continue working around the clock to bring systems back and great progress has been made.
So far, more than 50 internal and external computer systems and applications have been restored and are now operational.

These systems are at the Assessor’s Office, Code Enforcement, Criminal Justice Services, DSS, Finance, the Library, Park and Recreation, and the Sheriff’s Office.

A few notable applications that are now working include:

  • LUESA: Navision (LUESA revenue collections)
  • Public Health: Dentrix (dental clinic patient management system)
  • Park and Rec: Active Net (Park and Rec’s on-line registration and reservation system)
  • Library:  Smart Money Manager (Library’s point-of-sale system)
  • Office of the Tax Collector:  BizTax – internal only (business tax collection system)


 

NOTE: Some of these systems may be internal only and services may require customers to come on site. Please check with the respective agency or department first.

Multiple other systems are still being tested and should be restored soon.

 

Wednesday, Dec. 13

Progress continues as Mecklenburg County looks to restore online systems following the ransomware incident on Dec. 5.

There are now 27 applications that are back online and running, including the County’s financial systems used for processing transactions and financial reporting, Advantage and Info Advantage. However, the application is not yet available for use externally by vendors.
Among the applications and systems still being tested are those in Child Support Enforcement, LUESA/Code Enforcement and the Office of the Tax Collector. Restoration to several Criminal Justice Services with the Sheriff’s Office and the AOC are also now available.

Other systems that have been restored in the last day are at the Library, Criminal Justice Services, Skype for Business (for internal use only), the Assessor’s Office, and Code Enforcement. Multiple other systems are being tested and another significant batch should be online in the next few days. 

Code Enforcement is continuing a limited paper permitting process, and has resumed limited plan review using paper plans. In addition, inspections are being performed, but scheduled and managed manually. Complete details can be found here.

Turbo Court within Child Support Enforcement is up and functioning on a limited basis. Clients can enter an application but due to manual processing there may be a slight delay.

Re-watch the Information Technology Services Update

During yesterday’s Budget and Public Policy meeting, commissioners received an update on the ransomware incident from the County’s Information Technology Services Department. You can re-watch it here

Tuesday, Dec. 12

Important information of the Office of the Tax Collector.

Property Tax Deadline

  • The last day to pay real estate and personal property taxes is Jan. 5, 2018.
  • This is a statutory deadline that cannot be changed due to the cyber-attack.
  • Payments that are not received in the Office of the Tax Collector or postmarked by the United States Postal Service on or before Jan. 5, 2018 will be delinquent resulting in the assessment of additional charges.
  • Taxpayers should not hold their payments until the time when tax systems are restored, rather, tax payments are being accepted by mail using the envelope that accompanied the tax bill and in-person at Robert “Bob” Walton Plaza.
  • Taxpayers may not pay online, by telephone, or at the Wilkinson Boulevard office at this time.  The tax deadline will not be modified due to these service outages.
  • Upon restoration of the tax systems, payments made in person will be applied as of the date the payment was made. 
  • Mailed payments will be applied as of the date of the United States Postal Service postmark.  If no postmark is present, the payment will be processed as of the date received in the Office of the Tax Collector.
  • Payments made through an overnight express company will be processed as of the date received in the Office of the Tax Collector.  


 

Gross Receipts Tax Deadlines

  • The last day to pay the Room Occupancy Taxes, Prepared Food & Beverage Tax, Vehicle Rental Tax, and U-Drive It Tax continues to be the 20th of each month.
  • The last day to pay the Taxi Cab Privilege License Tax is Jan. 2.
  • These are statutory deadlines that cannot be changed due to the cyber-attack.
     Payments must be accompanied by a completed tax return or completed application as appropriate for the applicable taxes.
  • Payments that are not received in the Office of the Tax Collector or postmarked by the United States Postal Service on or before the last day to pay will be delinquent resulting in the assessment of additional charges.
  • Taxpayers should not hold their payments until the time when tax systems are restored, rather, tax payments are being accepted by mail and in-person at the Hal Marshall Services Center.
  • Taxpayers may not pay online at this time. The tax deadline will not be modified due to these service outage.
  • Upon restoration of the tax systems, payments made in person will be applied as of the date the payment was made. 
  • Mailed payments will be applied as of the date of the United States Postal Service postmark.  If no postmark is present, the payment will be processed in accordance with the administrative rules applicable to the tax. 
  • Payments made through an overnight express company will be processed as of the date received in the Office of the Tax Collector.  

Monday, Dec. 11

 Mecklenburg County continues working to restore services following the ransomware attack last week.

County Manager Dena Diorio reports that 16 applications are back online after nonstop work by Information Technology Services over the weekend and Monday. The applications are in the Department of Social Services,
Criminal Justice Services, Payroll Processing and Public Health.

County offices remain open even though some processes are slower than normal.

Multiple systems remain affected. Here are today’s updates.
 
Register of Deeds
• The Register of Deeds Office is conducting all  normal business, though public access computer terminals used for record research and other application capabilities are extremely limited. In addition, the system used to access funds for prepaid copies is unavailable.
 
Code Enforcement
• Code Enforcement is beginning a limited paper permitting process, and resuming limited plan review. Its primary focus will be on emergency/urgent projects.
• Permitting and plan review under this temporary process will require an in-person visit to the office and customers will need to bring multiple copies of paper plans and other paperwork.
• Code Enforcement strongly urges you to call the office and talk with our plan review staff about what documents you will need to bring with you. This will help to minimize any delays when you arrive at the office.
• Commercial customers should call 980-314-CODE and follow the prompts to speak with someone in the Commercial Technical Assistance Center (CTAC).
• Residential customers should call 980-314-CODE and follow the prompts to speak with someone from the Residential Technical Assistance Center (RTAC).
 
Office of the Tax Collector
• The Office of the Tax Collector can accept cash, check or money order payments at Bob Walton Plaza, if taxpayers bring their real estate and personal property tax bills with them. The Bob Walton Tax Office can now search 2017 property tax bills that were unpaid on November 27, 2017. Businesses can bring their completed tax return and pay gross receipts taxes at the Hal Marshall Center using cash, check or money orders. Taxpayers without a completed tax return will not be able to pay gross receipts taxes at this time.

 

Friday, Dec. 8

Mecklenburg County continues working to restore services following the ransomware attack earlier this week.

The good news is that County offices remain open even though some processes are slower than normal. Also good news, additional attacks on our system have been unsuccessful and we continue to rebuild and bring back services in our Health and Human Services area, Criminal Justice Services and Office of the Tax Collector.

However, multiple systems remain affected. Here are today’s new updates.

  • Code Enforcement will go to full paper mode on Monday, allowing them to begin issuing limited temporary/contingency building permits with prioritization on emergency permits.
  • The Office of the Tax Collector can accept cash, check or money order payments at Bob Walton Plaza, if taxpayers bring their real estate and personal property tax bills with them. The Bob Walton Tax Office also now has the ability to search 2017 property tax bills that were unpaid on Nov. 27, 2017. Businesses can bring their completed tax return and pay gross receipts taxes at the Hal Marshall Center using cash, check or money orders. Taxpayers without a completed tax return will not be able to pay gross receipts taxes at this time.



Thursday, Dec. 7

Two days after a ransomware attack that affected multiple County computer systems, Mecklenburg County remains open for business as it continues to methodically check and restore services.
 
The County continues to ask that all residents and employees remain patient. If you have business with the County, please call ahead to the department or service to determine if the service has been impacted.
 
Below is an updated status list of department systems that remain affected.
 
Assessor’s Office (CAO)
Non-Operational:

  • County Assessor’s Office reports AssessPro (The Real Property appraisal system), NCPTS (the personal property appraisal system and the billing and collection system) are down. 
  • Polaris and Tax Bill look up county web links are not working.

Criminal Justice Services

  • Criminal Justice Services is able to run jail population numbers through direct log-in.
     

Child Support Enforcement (CSE)
CSE is in full Manual Services- still seeing customers here and in the Courthouses, all records are being hand-written and the Clerk’s office is printing/making copies for the Court.

  •  Advantage is Down
  • ACTS- Automated Collection and Tracking System is down- which is used to interface with other state and federal systems; document generation; pay histories; charging and billing functions, etc
  • Compass/OnBase is down
  • Dept. Of Vital Records is down
  • Qflow- Used to track customer visits by date, time, visit purpose, service provider, etc.
  • VMWare
     

Community Support Services
The Domestic Violence Victim Services phone line (704-336-3210) is now fully functioning. 

Non-Operational:

  • ECHO for Substance Use Services (they are documenting on paper & will scan into the system once operational),
  • OnBase for Veterans Services & secure printing and copying.  We are seeing clients but Veterans Services may run slower.  As soon as we have access to a copier we will run much smoother.
  • All secure printing & coping DOWN.
  • Community Support Services Prevention & Intervention Division is unable to transfer a call from the receptionist to a clinician.
     

Department of Social Services (DSS)
All DSS services and programs are up and running with the exception of individual medical transportation scheduling. 

  • All Public Assistance programs and services are available.  We have made adjustments to work around the systems that are unavailable. 
  •  Adult Protective Services and Child Protective Services are fully operational.
     
    Transportation Message:
    If you have made a transportation reservation through DSS/MTS scheduling, please call Customer Connection at 704-336-4547 to confirm your transportation.  This includes reservations made for bus passes and vendor transportation for trips scheduled through December 11, 2017. 

Finance
Non-Operational:

  • Services/support are all manual and limited as most all of our work relies on Advantage as our core financial system.
  • Automated payments, invoicing, procurement, etc.  This means no Electronic funds transfers, processing of procurement requests in the system, or other similar transactions.  Because many of our internal controls are automated, or rely on systems (verifying funds, etc.), most of our services will be manual and slowed, but we should be able to perform them.  We also cannot apply payments received to the balance owed in the system—meaning we will have a backlog and some risk to the extent collections are continuing.

Human Resources
Non- Operational:
Applicants cannot apply for vacant positions
 
Library
No changes since last communication
 
 
LUESA
The LUESA offices on Suttle Ave continue to operate to provide services to our building community.  If you have urgent permitting and inspection needs, please call 980-314- CODE (2633) and staff will be able to coordinate your request for service.
 
Non-Operational:

  • Code and Storm Water Services cannot review plans or issue new permits until POSSE/Winchester and other supporting systems including GIS, Navision (payment processing) are up.
  • GIS cannot provide addressing and other services including processing register of Deeds data until the GIS servers are back on line.
  • Air Quality services for asbestos reviews etc cannot be performed until the permitting system is up.
     

MEDIC
Nothing affected at this time.

 

Office of the Tax Collector
Non-Operational:

• Property tax payments cannot be made at the Wilkinson Boulevard location.
• Tax records and payment information cannot be accessed online or by telephone.
• Research requests for bankruptcy, tax certificates, tax lien research, or any other service requiring reference to the tax records cannot be performed.
• All online services including online payment options are not available.

*Taxpayers can bring their tax bill and pay real estate and personal property taxes at Bob Walton Plaza using cash, check or money order. Business taxpayers can bring their completed tax return and pay gross receipts taxes at the Hal Marshall Center using cash, check or money order. Taxpayers without a tax bill or completed tax return will not be able to pay at this time.

 

Wednesday, Dec. 6

4:30 p.m. Update

Mecklenburg County Manager Dena R. Diorio announced this afternoon that the County will not pay ransomware criminals $23,000 to unlock many of the County’s applications that have been frozen since Monday.

“I am confident that our backup data is secure and we have the resources to fix this situation ourselves,” said Diorio. “It will take time, but with patience and hard work, all of our systems will be back up and running as soon as possible.”

Fixing the problem will require using backup data available prior to the incident to rebuild the applications from scratch. Affected systems will be prioritized with those affecting Health and Human Services, the Court system and Land Use and Environmental Services first.

All County offices remain open and departments have implemented alternative processes where necessary to continue serving customers in the interim.

Diorio says the decision came after consulting multiple experts in the cyber security field and realizing that the time difference to do it ourselves will not be significantly different.

“It was going to take almost as long to fix the system after paying the ransom as it does to fix it ourselves,” she said. “And there was no guarantee that paying the criminals was a sure fix.”

The County continues to ask that all residents and employees remain patient and understanding. If you have business with the County, please call ahead to determine if the service has been impacted.

 

Mecklenburg County is open for business, albeit somewhat slower with limited access to systems.

Following County Manager Dena R. Diorio’s announcement that a ransomware attack is behind the shutdown of many County IT systems, departments implemented paper processes and other solutions to continue serving customers.
 
There is no evidence at this time that personal, customer or employee information or data has been compromised.

The County is considering all options to fix the situation, including possibly paying the cyber criminals to unfreeze the system. The County is consulting with Federal, state and private stakeholders, including the FBI and Secret Service, while the County works to restore services.

We ask that all residents and employees remain patient. If you have business with the County, please call ahead to the department or service to determine if the service has been impacted.

Below are a few systems not available:

Human Resources
• Applicants cannot apply for vacant positions.

Tax Office

  • Property tax payments cannot be made at the Wilkinson Boulevard location.
  • Tax records and payment information cannot be accessed online or by telephone.
  • All online services, including online payment options, are not available.
  • Payments made by mail will not be posted until tax systems are available.
  • Once tax systems are available, payments received by mail and in person will be posted in the order received resulting in a delay in checks being cashed.
  • Real estate and personal property tax payments can be made in person at Walton Plaza if the taxpayer presents the bill(s) with payment. We do not have the ability to look up bills for the taxpayers to pay.
  • Gross receipts tax payments can be made in person at the Hal Marshall Center if the taxpayer presents the completed tax return(s) with payment. We do not have the ability to look-up information for taxpayers.
  • Payments must be made with a check, money order, or cash.  Credit and debit card payments cannot be accepted.

 

Register of Deeds

  • All computers used to complete marriage applications, assumed business names research and filing, and record research are not operational. 
  • Many professionals that frequent the ROD for research have prepaid for copies, they will be unable to access those funds for those services as well.

 

LUESA

  • Code and Storm Water Services cannot review plans or issue new permits.
  • GIS cannot provide addressing and other services.
  • Air Quality services for asbestos reviews, etc. cannot be performed until the system is up.
  • Code enforcement inspection process will be slowed due to paper process.

 

Assessor's Office

  • County Assessor’s Office reports AssessPro (The Real Property appraisal system), NCPTS (the personal property appraisal system and the billing and collection system) are down. 
  • Polaris and Tax Bill look up county web links are down.

 

Park and Recreation

  • Online reservations are down.

 

Department of Social Services
Transportation Message:
If you have made a transportation reservation through DSS/MTS scheduling, please call Customer Connection at 704-336-4547 to confirm your transportation.  This includes reservations made for bus passes and vendor transportation for trips scheduled through Dec. 11, 2017. 

Child Support Enforcement

  • Please call your agent to see if services are available.

 

Finance

  • Automated payments, invoicing, procurement, etc. This means no Electronic funds transfers, processing of procurement requests in the system, or other similar transactions at this time.