Portland, Ore. email data breach losses reach $1.4M

Portland, Oregon has recorded $1.4 million in losses as a result of a data breach stemming from the compromise of a government email account, reports StateScoop. While the threat actor was able to conduct the "fraudulent financial transaction" in late April, the attack was only identified on May 17 during another fund transfer attempt, according to Portland's Office of Management and Finance. "Preliminary evidence indicates that an unauthorized, outside entity gained access to a City of Portland email account to conduct this illegal activity," said officials in a statement. Aside from tasking a cyber incident response team to address the fraudulent transactions, the city has also sought the assistance of the Portland Police Bureau, the FBI, and the U.S. Secret Service. The attack comes after the FBI warned states and local governments regarding the growing prevalence of business email compromise attacks. "Rapid adoption of ad-hoc teleworking environments driven by the COVID-19 pandemic coupled with the ease of BEC operability against SLTT government entities and vendors has exacerbated cybersecurity challenges," said the FBI in a March 2021 alert.