Vendors and businesses that work with the state are advised to be cautious about emails that seem to be from state employees.
The state Office of Enterprise Technology Services announced that several vendors that contract with the state government have received scam emails from addresses spoofing government employee emails and claiming to request payments on behalf of the state.
Keith Regan, director of the Department of Accounting and General Services and Acting Lieutenant Governor, told Aloha State Daily the scam emails use the names of specific employees who vendors may have working relationships with, but without the standard “@hawaii.gov” domain. He added that it’s unclear if the scammers are sophisticated enough to specifically use government employee identities with prior histories with a targeted vendor.
“It’s like ‘hawaii.us’ or something like that, but someone could be deceived by it,” Regan said. “So if someone, a vendor has been dealing with one of those individuals and they think they get an email from that person, they may think that this is legitimate.”
In some cases, the false emails requested a $400 deposit that would supposedly allow the vendor to access a verification system, which Regan said doesn’t correlate with any state business practices, but might seem innocuous enough for some to accept it.
So far, Regan said no vendor has reported that they have actually been scammed by these emails, but only four or five scams have been reported to the Office of Enterprise Technology Services.
“A number of these folks reached out and said, ‘hey, is this legitimate?’” Regan said, adding that vendors should reach out to ETS to confirm suspicious emails.
Among other things, vendors should confirm with the state Procurement Office before responding to any unfamiliar request, and confirm with a state agency directly before making any requested payment.
However, Regan emphasized that the incidents likely do not represent a cybersecurity failure on the state’s end.
“Our names are out there on our website,” Regan said. “The state procurement office, as an example, has a website that posts procurement information electronically, and so there are people’s names included in that, and I’m sure that’s how they’re picking up all this information.
“The way that the world is changing so quickly with AI, these bad actors are finding all kinds of ways to get through even some of the most sophisticated email systems,” Regan continued. “There’s not much we can do except just make sure that our people and our vendors and anyone that’s interacting with us at some level … are taking steps and making sure that any communications that appear to be coming from the government are in fact coming from the government.”
For the latest news of Hawai‘i, sign up here for our free Daily Edition newsletter.
