Phishing scam uses public's right to information to target state and local governments

Indianapolis Star

20-06-2025

Hoosiers can request a broad range of information from their local and state governments, such as police reports, contracts, policies and email communications.
A recent phishing attack is twisting that right to information into a means to scam state and local government workers.
Employees have reported that a recent surge of emails are posing as public records requests and encouraging records to be uploaded to a hyperlink.
The Indiana Office of Technology is aware of the emails and has found them to be fraudulent, according to one of its email newsletters.
Spokesperson Aliya Wishner said the city of Indianapolis' information services agency is aware of the phishing scam. The city uses a software system to fulfill records requests, not through email.
One of the phishing emails obtained by IndyStar was sent from the domain "@recordsretrievalsolutions" and sought five years of information about an agency's purchase orders.
Indiana's technology office said employees should be cautious with any emails from that domain and any contacts from Records Retrieval Solutions. The office said the scammers are pretending to be the Florida-based company.
In light of the phishing scam, the office recommends that workers question whether a records requests is legitimate. Guidance includes contacting the sender to discuss the request, verifying the entity that's making the request, and searching the email text for red flags like hyperlinks.
Under Indiana's Access to Public Records Act, members of the public have the right to request a wide swath of information held by government agencies. Some information may be withheld or redacted for legal or investigation reasons.
The USA TODAY Network - Indiana's coverage of First Amendment issues is funded through a collaboration between the Freedom Forum and Journalism Funding Partners.