Suspicious Email Sent Out

Update timeline

1. investigating Sep 08, 2026, 03:50 PM UTC

   Warning: Judiciary Suspicious Email Notice Montpelier, VT - The Vermont Judiciary is aware of a suspicious email that has been sent from a Judiciary email address. The message includes a PDF attachment and a passcode to open the attachment. If you receive this email, do not open the attachment or use the passcode. Please delete the email. If you opened the link, it is recommended that you change your password on the device you were using when you received the email. If you provided your email address and password, it is recommended that you contact your IT support staff for further instruction. We are investigating the matter and will provide additional information as needed. Thank you for your cooperation.

2. resolved Sep 17, 2026, 11:53 AM UTC

   We’d like to explain what happened with the phishing email that was sent out, and what was done in response. We’d also like to provide additional information about cybersecurity incidents of this type. # What happened A Judiciary mailbox was compromised and used to send phishing messages that appeared to come from Judiciary staff. Because the messages were sent from a legitimate (although compromised) vtcourts.gov account, they passed normal email authentication checks and appeared to recipients as legitimate Judiciary email. We thank the many recipients who immediately contacted us nonetheless to inquire about the email. This enabled us to respond very quickly to the incident. # What we did in response We secured the affected account, revoked active sessions and access tokens, and removed known malicious messages from Judiciary mailboxes. The compromise of the Judiciary account was quickly contained. We issued a press release, posted a security alert on the Judiciary website and requested the Vermont Bar Association to post and distribute the security alert to its membership. We’re very grateful to the VBA for its immediate cooperation. # Information about cybersecurity incidents of this type The messages typically include: - A short note asking you to review an attached document and get back to the sender. - A password-protected PDF attachment, with the password provided in the body of the email. - A PDF containing little or no actual content and a link labeled “Press to view document.” Never enter a code into a Microsoft sign-in prompt unless you initiated that sign-in yourself on a device in front of you. If an unsolicited email, document, or website instructs you to copy a code into a Microsoft sign-in screen, treat that instruction as a phishing attack. # What to do if you receive such a message in the future Do not open the attachment, follow the link, or reply to the message. If you are uncertain whether a message from a Judiciary employee is genuine, contact that person using a phone number or other contact information you already know to be valid. Do not use a phone number or link contained in the suspicious message itself. Report the message to your firm’s or organization’s IT support and then delete it. Your organization’s IT staff administer your mailbox and account security and are best positioned to investigate or take action on your account. If you would also like the Judiciary to know that you received one of these messages, you may forward it to [email protected]. # If you act on such a message If you only open the PDF attachment but do not follow the link or complete the Microsoft sign-in process, report the message and delete it. If you follow the instructions, enter the displayed code, and complete a Microsoft sign-in, treat this as urgent. A password change alone may not be sufficient because existing sessions or authorization tokens may also need to be revoked. Contact your own IT support immediately and explain that you entered a device or verification code provided through a phishing message and subsequently completed a Microsoft sign-in. Ask IT to investigate the account, revoke active sessions and associated tokens as appropriate, and determine whether additional remediation is necessary. # About this notice This notice contains no attachments or links. Judiciary IT will not send you an unsolicited message asking you to enter a verification code, sign in through a password-protected document, or use a code supplied in an email or document to authorize a Microsoft sign-in. Thank you for your vigilance and for your attention to the cybersecurity trainings you receive. We will do our best to ensure that the same incident does not happen again.