In their warnings, the states caution vendors to check all messages for authentic email addresses, use official websites to access information and report any suspicious email.
Two states — Hawaii and Connecticut — have issued new warnings to businesses scammers impersonating government agencies and sending fraudulent emails, requesting payments or asking that recipients log into portals.
The Hawaii Department of Accounting and General Services issued its warning after vendors reported suspicious communications to the state’s procurement office, including fraudulent emails requesting vendors make $400 deposits and complete a form appearing to come from the Hawaii State Archives, according to
There have also been reports of emails impersonating other agencies, including the tourism and budgeting agencies.
“These reports are concerning because they involve multiple state agencies and the businesses that rely on them,” said state CIO
in a statement. “We are working across departments to address these threats and reinforce the importance of protecting the integrity of government operations.”
noted that scammers can exploit the identities of government agencies even when systems haven’t been compromised.
“These scams are designed to exploit the trust that businesses and the public place in government agencies,” Hoang said.
Officials went on to say that the Hawaii Office of Enterprise Technology Services has worked to strengthen email security and prevent unauthorized use of Hawaii.gov addresses. Most executive branch emails use the
, and the office continues to work with offices to expand it.
In Connecticut, Secretary of the State Stephanie Thomas
Wednesday phishing emails sent under the guise of the office’s Business Services Division. Those fraudulent messages claim that a secure document was shared with the recipient, directing users to download an attachment by entering an access code through a fake portal.
“Cyber criminals are getting more sophisticated, and it’s critical that businesses stay alert,” said Thomas in a statement. "If something feels off, trust your instincts and verify before you click."
The Connecticut warning included an example of a fraudulent email sent from a .com address, noting that legitimate emails from the secretary of the state’s office will be from an email address that ends with @ct.gov. Businesses were also advised to access the state’s official business filing portal directly rather than following links in emails. They are also advised to enable multifactor authentication.
Massachusetts issued a similar warning in
The Massachusetts Office of the Comptroller
falsely claiming that the state had implemented a new secure email system requiring recipient registration. The office said that no such change had been made. Earlier scams also spoofed Massachusetts agencies, requesting vendors to fill out electronic funds transfer authorization forms for banking.
The comptroller’s office recommended vendors receiving unexpected links, attachments or requests for sensitive information to verify communications with a trusted source by phone, video call or in person.
These communications reflect tactics associated with business email compromise, a form of fraud targeting businesses and individuals that work with suppliers or regularly conduct wire transfers. Criminals use compromised communications, social engineering or other techniques to trick recipients into transferring funds to unauthorized accounts.
This resulted in more than $3 billion in reported losses in 2025, according to the
Officials in Hawaii and Connecticut, meanwhile, urged businesses to scrutinize email addresses, avoid suspicious links and attachments, and independently verify unexpected requests for payments or sensitive information.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
