SALEM, OR — After hackers dumped 1.3 million files from the Oregon Department of Environmental Quality onto the dark web, state officials quickly reassured the public with the kind of soothing, half-hearted optimism that has become an Oregon trademark: "Don't worry, your data's probably fine, maybe, who knows."
The DEQ, responsible for regulating the air, water, and now apparently the free flow of private citizen data across the dark web, admitted they have no idea how much was actually stolen. "We think most of it was just employee records," said one spokesperson while nervously refreshing their Gmail inbox, "but it could also be everyone's car registrations and blood types. It's honestly too soon to tell."
The ransomware group Rhysida, which successfully breached the agency, claimed they tried contacting DEQ before leaking the files, but apparently emails to "@oregon.gov" are treated with the same urgency as expired coupons. Within days, 2.4 terabytes of data were available to anyone with a dark web browser and a mildly curious attitude.
This comes nearly two years after Oregon faced a catastrophic failure at the DMV, when a 2023 data breach compromised the personal information of 90% of Oregonians with a driver's license or state ID. That hack, tied to a MOVEit Transfer vulnerability, exposed millions of names, addresses, license numbers, and social security digits — a historic blunder so severe that the DMV briefly considered issuing everyone in the state a new identity and just calling it a fresh start.
"Sure, we had the DMV thing," said one DEQ official, "but we’ve learned a lot since then. For example, we learned that when hackers steal everything, it's important to send out at least three press releases pretending it didn’t happen."
Do you love Oregon?
Sign up for monthly emails full of local travel inspiration and fun trip ideas. In each newsletter we'll share upcoming events, new things to do, hot dining spots and great travel ideas.
After initially freezing services and denying a breach, DEQ officials have since admitted the incident was, in fact, an "unexpected cyber attack" — a term they carefully crafted after rejecting the more accurate "total digital dumpster fire."
Meanwhile, emissions testing across Portland and Medford was suspended, laptops were unplugged, and DEQ staff spent a week squinting at smartphones, valiantly trying to govern the state's environmental standards via text message.
When pressed about the repeated cybersecurity disasters, Oregon leaders unveiled a bold new multi-point recovery plan:
- Step 1: Hope the hackers feel guilty.
- Step 2: Pray really hard.
- Step 3: Offer the hackers state jobs since they’re clearly better at managing the data.
At press time, officials were seen brainstorming additional solutions, including installing Norton Antivirus circa 2007 and blaming everything on "a mysterious cosmic force beyond human control."
Oregonians are advised to monitor their credit, bank accounts, and emotional stability until further notice.
