Oregon DCBS Alerts Peers, Customers to Phishing Incident

Oregon — DCBS Information Regarding Phishing Incident: The Department of Consumer and Business Services (DCBS) recently identified and responded to a phishing incident involving a single employee email account. This message follows, to provide general information to our peers and customers.

On or around Aug. 26, 2026, phishing emails were sent from one DCBS email address to a number of internal and external recipients. Individuals and organizations who were known to have received the phishing email were directly notified and provided information about what to look for and what actions to take in response.

Based on the investigation to date, no additional compromise has been identified. The compromised employee account was quickly identified, the malicious activity was stopped, and available phishing messages were removed from State-managed email systems.

DCBS, working with the State’s cybersecurity team, will complete its review of what happened. As part of the follow-up, DCBS will provide additional phishing awareness training to employees and reinforce existing security practices related to suspicious emails, attachments, links, and requests for login credentials.

Phishing remains a common method used by cyber threat actors to gain unauthorized access to organizational accounts. DCBS remains committed to protecting State systems and information and will continue taking appropriate measures to reduce the risk of similar incidents.

For more information, please contact Division of Financial Regulation Deputy Administrator Alex Cheng at Alex.Cheng@dcbs.oregon.gov.