Oregon environmental agency shuts down network after cyberattack

Oregon's Department of Environmental Quality took its network offline on Wednesday, April 9, 2025 in response to a cyberattack, closing vehicle emissions inspection stations across the state.

The state's central IT agency, Enterprise Information Services, began shutting systems down to isolate and potentially eradicate the intrusion. DEQ said its network systems and computers would remain unavailable until the attack was fully contained. Its own IT staff worked alongside Enterprise Information Services and Microsoft's cybersecurity team on the response, and an external digital forensics firm was later brought in.

The closures affected DEQ Clean Air Stations in the Portland metropolitan area, Medford and parts of the Willamette Valley, where an emissions test is required to register a vehicle in certain areas. Stations were shut from April 10 to April 12. The Medford station reopened on Monday, April 14 and Portland-area stations resumed regular hours on Tuesday, April 15. Your DEQ Online, the agency's environmental data management portal, stayed available throughout because it runs on a separate server.

The agency released little detail about how the attackers gained access and did not say whether ransomware was involved. The Rhysida ransomware group claimed responsibility the following week, saying it had taken 2.5 TB of files including employee data, and demanded 30 bitcoin, about $2.5 million. It stated that it had not engaged in any ransom discussions and that it had found no evidence of a data breach, while noting it was hard to estimate when the forensic review would conclude. Its April 15 update neither confirmed nor denied a breach, and on April 24 and 25 Rhysida published about 1.3 million files, 2.4 TB in total, on the dark web. DEQ did not confirm whether employee data was taken.