Hackers breach NY-Alert system; state officials say ignore any message about transactions

Syracuse, N.Y. – The state’s NY-Alert app was hacked last week, sending a message a bogus transaction to the phones of tens of thousands of people signed up to get emergency notifications, state officials confirmed.

The phishing notice pinged 163,000 phones, or 87% of the accounts signed up for the state’s emergency notices, according to Scott Reif, spokesperson for the New York State Office of Information Technology Services.

The state is warning people to ignore any notice from NY-Alert that asks the recipient to inquire a fake bank transaction.

“We are aware of a text message sent in error to some members of the public,” Reif said. “Do not to the text message or call the phone number. This text message was not sent by New York State, and an investigation is ongoing by the vendor.”

The messages came through Mobile Commons, the company that handles alert system text messages for the state.

One of the hacked messages viewed by syracuse.com arrived the evening of Nov. 10:

“B OF A: Transaction of $723.42 was declined. Confirm if this was you: (888) 836-4437. YES to confirm.”

“The message was sent in error and not on behalf of New York State. Do not to this message or call the phone number.”

Mobile Commons CEO Jed Alpert said in an emailed statement that an “unauthorized third-party” gained access to the platform for four hours before the scam was detected and stopped.

He said the company blocked a second attack Nov. 13.

Alpert said the company is taking steps to make the system more secure and said they have “locked down messaging” on its platform until the “company is confident that the platform is secure.”