Prineville, OR — The Oregon Department of Environmental Quality (DEQ) is working to recover from a significant cyberattack that has disrupted operations and raised concerns about data security.
On April 9, DEQ identified a cyber intrusion that led to the shutdown of its network systems, including email services and vehicle inspection stations in the Portland and Medford areas. The agency’s environmental data management system, Your DEQ Online, remained operational as it is hosted on a separate server.
Initially, DEQ reported no evidence of a data breach. However, the ransomware group Rhysida later claimed responsibility, alleging the theft of 2.5 terabytes of data, including sensitive employee information. The group demanded a ransom of 30 bitcoins (approximately $2.5 million) and subsequently released over a million files on the dark web.
In response, DEQ has undertaken extensive recovery efforts, including rebuilding servers and employee computers to ensure no malicious software remains. The agency has also implemented enhanced cybersecurity measures, such as updated security software and hardware, and revised cyber hygiene policies.
Vehicle inspection stations have gradually resumed operations, with DEQ-operated sites reopening on April 14. However, third-party “DEQ Too” locations remain offline. DEQ has extended public comment periods for certain permits to accommodate communication disruptions during the outage.
The Oregon Department of Administrative Services’ Enterprise Information Services is assisting DEQ in the ongoing investigation and recovery process.
The incident comes at a time that DEQ has been playing a role in multiple Crook County issues stirring controversy: including water qualify issues northwest of Prineville that residents alleged is due to a mine operation by Knife River, as well as a proposed urban growth boundary expansion by the City of Prineville for a proposed biomass plant.
