Oregon DEQ Data Breach Exposes Personal Information of 4,800 Individuals In April 2025, the Oregon Department of Environmental Quality (DEQ) suffered a cyberattack that compromised the personal data of approximately 4,800 individuals. The breach, attributed to the ransomware group Rhysida, went undisclosed to the public for months, with affected individuals only notified in late December nearly nine months after the incident. The attack disrupted DEQ operations, leaving staff without computer access for nearly two weeks. While the agency initially denied a data breach, investigations later confirmed that sensitive information including Social Security numbers had been exposed. The leaked data, tied to "older records," primarily affected individuals outside DEQ, such as those who had participated in asbestos removal training programs years prior. DEQ acknowledged the breach only after inquiries from OPB, revealing that it had known about the leak since June. Oregon law does not require public disclosure of such incidents, so the agency opted to notify affected individuals directly via mail. However, the delayed notifications some sent as late as December 30 raised concerns among recipients, including retiree Jack Terrill, who initially suspected the letter was a scam due to its vague details and lack of public confirmation. The letters, postmarked from West Sacramento, California, included links to IDX, an identity protection company contracted by DEQ. Cybersecurity experts emphasized the importance of verifying such communications, particularly for vulnerable groups like seniors. Terrill’s attempts to confirm the letter’s legitimacy through DEQ were met with unreturned calls and voicemail messages, further fueling skepticism. DEQ defended its notification process, stating that a manual review was necessary to ensure accuracy and avoid duplication. The agency notified 80 individuals in August, 191 in September, 12 in early December, and the remaining 4,544 on December 30. The breach’s origins remain under investigation, though records suggest a hijacked website link in a DEQ press release may have been the entry point for the attackers. Rhysida later released 1.3 million files totaling 2.4 terabytes on the dark web, some of which contained DEQ employees’ personal information. The ransomware group initially demanded $2.5 million for the stolen data. DEQ has since updated its data retention policies, stating it no longer collects the type of information compromised in the breach. A criminal investigation into the incident is ongoing.