Scans this week performed by the State Chief Information Office (OSCIO) identified potentially malicious activities on two information servers operated by the Department of Environmental Quality. The agency has taken steps to protect sensitive information and eliminate any future intrusion to the agency's information technology systems. Forensic investigations by security experts are ongoing to determine the extent of the incident.
At this time, there is no evidence that sensitive information about individuals, businesses or facilities has been compromised. The agency maintains about 9,000 Social Security Numbers and contact information for about 1,500 current and former employees elsewhere in their network.
If continued investigations do identify compromised sensitive information, OSCIO will work with DEQ to notify and support affected individuals. Support could include providing credit monitoring, if necessary.
At Governor Brown's direction, the OSCIO is conducting a systemic cyber security assessment of all state agencies, starting with the biggest or those agencies having extensive public interactions. These assessments are a proactive effort by the state to minimize risk to the state's electronic information systems, to best protect Oregonians and businesses.