Oregon lawmakers are expected to vote on a budget bill this week that includes $1.1 million in costs borne by a state agency following a cyberattack last year.

On Tuesday, a legislative budget committee advanced a bill that includes money to help the Oregon Department of Environmental Quality recover from last year’s cyberattack. That bill will likely get a vote on the House floor this week.

In early April 2025, DEQ had to shut down its computer network after hackers appeared to breach its systems.

The agency subsequently had to wipe all employees’ computer hard drives, and about 450 computers had to be replaced. Over the following months, state investigators determined that 4,800 members of the public had their personal information leaked.

In all, the attack cost DEQ about $2 million.

The agency has remained mostly silent about the attack, to the extent that some people couldn’t reach agency staff to verify their information had been leaked.

Some lawmakers have also struggled to get details about the cyberattack from DEQ.

In January, DEQ Director Leah Feldon spoke to a legislative subcommittee about the agency’s budget request. During that meeting, Rep. Vikki Breese Iverson, a Republican from Prineville, detailed her struggle with reaching DEQ.

“I think as late as December 12th, I got, ‘We’re still checking on additional information. We’ll get back to you,’” she said of her email exchanges with agency staff.

Most people affected by the breach didn’t receive notifications until late December, even though it had been six months since investigators confirmed that those people’s information had been leaked.

Breese Iverson said she worried about how long it took the agency to notify people.

“I’m concerned about the response, and I’m concerned about how things happened and how wide open we left somebody with their Social Security number being accessed,” Breese Iverson said.

Feldon told lawmakers that state investigators have determined the cause of the cyberattack, but that information and other details need to stay under wraps to protect the investigation.

“Because the investigation itself is actually still ongoing into who did this, why, and how things can be protected in the future,” Feldon said in January.

Feldon said the agency was careful about providing services to people whose information had been leaked.

“Whenever possible, we took a trauma-informed approach to best care for those impacted,” she said.

If the budget bill is approved, DEQ’s funding request will come out of the state’s all-purpose general fund. The request seeks $32,500 for consulting with the Oregon Department of Justice and $75,650 to pay a communications strategist on loan from the Oregon Department of Transportation “to support the response effort and messaging discipline.”

The other $1 million will pay for a contract with IDX, a cybersecurity firm that helped analyze the attack and notified people affected by it.

News Source : https://www.opb.org/article/2026/03/03/oregon-department-environmental-quality-cyberattack-cost/