Oregon DEQ data breach leaked thousands of people’s information, but the agency hasn’t told the public
TL;DR
A cyberattack on Oregon's DEQ exposed personal data of about 4,800 people, but the agency delayed public disclosure for nine months and only confirmed the scope after media inquiries.
Source: Oregon Public Broadcasting (OPB)
About 4,800 members of the public had their personal information exposed after a cyberattack on the Oregon Department of Environmental Quality’s servers — but nine months later, the agency has yet to publicly disclose the scope of the leak. As OPB previously reported, many DEQ staff were without access to their computers for close to two weeks after an Apr. 2025 cyberattack. But the agency only confirmed that the leak was much larger than first reported — and that personal data of thousands of people had been leaked — in response to questions from OPB last week. DEQ appears to have known about the leak since Jun. 2025. Most people affected by the breach didn’t receive notifications until late Dec. 2025. Full Story