SALEM, Ore. (AP) — A piece of third-party software that hadn’t been updated might have been the vulnerable point invaded by hackers of the Oregon secretary of state’s website, a state report found.

The February breach took election and business records offline for nearly three weeks, delaying disclosure of campaign-finance information and forcing staff to handle many functions by hand.