SALEM, Ore. (AP) - Secretary of State Kate Brown has informed the Oregon Legislature that she’ll be asking for money to hire a security contractor to fix her website, which was taken offline after hackers broke in.
Brown’s office hired a contractor to review security upgrades and another to help manage communication with website users, said Tony Green, a spokesman for the secretary of state’s office.
Brown’s office has cut off access to the state’s business registry and campaign finance records since the hacking was discovered Feb. 4. Officials have said little about what information was compromised or when the website will work, but they insist personal information is safe. The hackers did not get access to the state’s central voter registration database, officials say.
Green declined again Friday to say when the website might return or whether the public can be assured of having access to campaign finance information before the primary in May or local elections next month. The office has suspended fines for businesses that are late in paying annual fees.
“We have been literally working overtime and every single day since we detected this to get it up and running,” Green said. “First thing we have to do is make sure we can get it up securely. I think the only thing that would be more frustrating than the current situation is if we put it up prematurely and then experienced additional problems.”
The state last week signed a contract with Virtual Security Research LLC of Boston. The company will be paid $10,000 to review the work done by state experts, help determine the extent of damage and recommend strategies to fix problems, according to the contract.
This week, Brown’s office emailed 338,000 people who have created accounts in its online systems informing them of the breach and telling them they’ll have to choose a new password next time they log in. People who use the same password for other services were advised to change those access codes as well.
A separate contractor was hired to handle the communication with the public, including phone calls resulting from that email. Green said the firm, Portland-based ID Experts, will be paid $40,000, plus $1.50 per minute they talk with callers. The number of calls was unavailable, he said.
The agency said that bank account numbers for political committees are encrypted, but users were advised of steps they can take to monitor their credit and identity. Officials have said the incident has been reported to law enforcement.
The total cost to resolve the issue and mitigate the damage won’t be known until the website is back online, Green said.
Rep. Peter Buckley, an Ashland Democrat who co-chairs the budget committee, said Brown told him the price tag would be relatively small.
“It’s not going to be a mind-blowing cost,” Buckley told The Associated Press.
The funding request probably won’t be ready for the full Legislature, which is in session for two more weeks, Buckley said, so it will likely go to the Emergency Board in May.
___
Reach AP reporter Jonathan J. Cooper at https://twitter.com/jjcooper .
Please read our comment policy before commenting.