State officials are investigating a major cyberattack on the government agency charged with drafting state budget bills.

The investigation comes as the Legislature and governor are finalizing the details of the $237 billion state budget.

“It was unexpected. The 4:30 a.m. call said the commission that’s responsible for legislative bill drafting was under attack,” Gov. Kathy Hochul said in an interview with NY1.

Hackers attacked the Legislative Bill Drafting Commission — the primary system used to print the final version of Hochul’s state budget.

“It’s under an active investigation. So we’ll be disclosing as much as we can when we’re able to, but this is very active. There were impacts, but we’re still very much functioning,” Hochul said. “This is, right now, confined to the legislative bill drafting commission. It’s actually run by appointees from the Speaker and the Majority Leader. And it’s an independent commission, to my knowledge, that is the extent of the attack.

Lawmakers shared their initial reactions.

“Well, the timing is very suspicious. No question. Although, there’s no evidence yet to link it any way to the budget or the closing down of the budget,” Democratic State Assemblyman David Weprin said.

“I couldn’t help but chuckle to myself, wondering, ‘everyone’s hating the budget?’ Because it’s that type of year. The more it gets delayed, the more everybody gets unhappy,” Democratic State Assemblywoman Pat Fahy said.

Although the incident appears contained, Hochul did not confirm whether the hit qualifies as a ransomware attack — a situation where hackers hold private data hostage, and often request large sums of money for their return.

“If this is a ransomware attack and the attackers have communicated with them saying ‘pay us,’ then the question becomes: do you pay them? If you do, you get the data back instantly but it may not come without embedded malware,” Michael Balboni, who served as the State Power Authority’s chair of the Cyber and Physical Security Committee, said.

New York ranks third nationwide for the most ransomware attacks, according to a state comptroller’s report released last year. Attacks on critical infrastructure nearly doubled within the first six months of 2023.

“Typically, the justice department has said municipalities are not supposed to be paying these bad guys because that money could be used for all sorts of things,” Balboni said.

Balboni said the governor takes these threats seriously, appointing the state’s first Chief Cyber Security Officer and investing millions in cyber security infrastructure.

“I cannot tell you how many attacks have been thwarted,” Hochul said.

But some lawmakers still worry about future weaknesses.

“It’s very alarming and we know that there’s been a massive shakedown of municipalities, counties, school districts and they’ve been paying because of this shakedown. I don’t know how the government is going to catch up with this type of fraud and cyberattack and the ransomware,” Fahy said.

Just two days after Hochul announced a budget deal, the attack forced the state to revert to a backup system capable of printing bills — one that dates back to 1994.

“It really would be premature for me to say anything conclusive at this time, just like any crime scene. This is evolving. This is the first hours of an evolving situation,” Hochul said. “Right now, we still expect the legislature to be able to vote as they scheduled, probably Thursday and Friday.”

Lawmakers are expected to pass another budget extender that could stretch into early next week in order to pass the entire state budget.