Half a Billion Reasons: Why Cybercrime Is Now an Operating Risk for Hawaii Employers
Nitin Aggarwal
GM of Cyber Services at ProService Hawaii
Cybercriminals may have impacted Hawaii residents and businesses to the tune of an estimated half a billion dollars last year.
That number sounds shocking – and it should. A look at the last three years of the FBI's IC3 (Internet Crime Complaint Center) data tells a clear story: cybercrime is accelerating, and local employers are increasingly in the “blast zone.”
The 2025 Estimated Forecast
Based on historical IC3 patterns and growth rates, our analysis suggests Hawaii is on pace in 2025 for:
- 3,100-3,300 individual cybercrime complaints.
- A 17%-33% higher volume than previous annual averages.
- $100M+ in reported losses.
The "True Number" of Cybercrime:
Cyber Security experts estimate that only about 20% of cybercrime is ever formally reported. If these reporting trends hold true, the “true” economic impact on the islands likely exceeds $500 million.
For business owners, this isn’t just an “IT” issue. Cyber incidents disrupt ability to make payroll, delay vendor payments, create massive compliance exposure, and damage the most fragile assets of all: employee trust and customer confidence.
This Isn’t a Mainland Problem. It’s Happening Here.
Cybercrime in Hawaii isn’t theoretical. It is local, and it often starts with a single call, click, or login. Here are recent examples of the landscape our local businesses are navigating:
- Kaimana Beach Hotel (Remote Access Scam): Scammers posing as IT support allegedly targeted front-desk employees, seeking to grant remote access and trigger rapid-fire wire transfers totaling over $130,000.
- $8.2 Million Business Email Fraud: Federal reports have highlighted Hawaii companies losing millions after fraudulent payment instructions redirected funds – a classic invoice diversion scheme that begins with a simple compromised email account.
- Hawaiian Airlines (Cybersecurity Event): In June 2024, Hawaiian Airlines reported a cybersecurity event impacting internal IT systems. Even when planes keep flying, the response, investigation, and reputational costs are significant.
- Hawaii Nonprofits (Fake Donation Check Scheme): The Hawaii Attorney General recently warned local nonprofits about counterfeit donation checks followed by urgent “refund” requests, leaving organizations responsible when the checks eventually bounced.
- Bank Teller Computer Fraud Case: A case involving unauthorized withdrawals totaling $44,000 via internal access highlights how weak digital permissions can enable fast, local losses.
The Controls That Stop the Most Common Hawaii Scenarios
Most local incidents fall into predictable categories: Phishing, Payroll diversion, Vendor payment fraud, and Remote-access scams. We recommend employers adopt this practical prevention checklist:
Protect Your People & Assets
- Require MFA: Multi-factor authentication is the single most effective hurdle for email, payroll, and banking.
- Cyber Insurance: Maintain stand alone cyber insurance with appropriate coverage. Modern carriers often provide pre-breach tools and emergency response teams that are invaluable during an incident.
- Micro-Training: Conduct short, recurring training on how to spot a “sense of urgency” in phishing emails.
Harden Payment Processes
- Out-of-Band Verification: Always call a known, trusted number to verify any change in bank or payment instructions.
- Dual Control: Enforce two approvals for any wires, ACH transfers, or new vendor setups.
- Access Controls: Restrict who can modify payroll or vendor banking information
Reduce Your “Blast Radius”
- Test Backups: Ensure your data is recoverable and isolated from your main network.
- Regular Patching: Keep systems updated to close known security holes.
- Remove Unused Accounts: Deactivate access for former employees or contractors immediately to prevent dormant accounts from being exploited.
- Restrict Administrative Access: Limit “super-user” or admin privileges to only those who absolutely need them for their specific job functions.
If You’ve Been Hit: The First-Hour Playbook
When a breach happens, time is your enemy. Your goal is to contain, preserve, and stop the money.
- Contain: Disable compromised accounts and reset passwords immediately.
- Contact Cyber Insurance: Immediately notify your carrier. They deal with these incidents daily and can provide specialized legal, forensic, and PR support that small internal teams lack.
- Call Your Bank: Every minute counts for a wire recall. Request a “fraudulent transfer” hold.
- Preserve Evidence: Save emails, logs, and screenshots. Do not “wipe” systems until forensic experts advise otherwise.
- Report: File a report at IC3.gov and notify local law enforcement.
Prevention over Remediation: An Investment, Not an Expense
The cost of recovering from a breach—including downtime, legal fees, and lost trust—almost always dwarfs the cost of prevention. Forward-thinking HawaiÊ»i employers are shifting from “reacting” to “proactive monitoring.”
- Managed Cybersecurity: Outsourcing your defense to professionals ensures 24/7 monitoring. Proactive detection can stop a breach before a single dollar leaves your account.
- External Audits: Periodic “stress tests” by third-party experts can find the process gaps that internal staff might miss.
- Building a Security Culture: Awareness isn't a one-time meeting; it’s an ongoing operational value. When employees feel empowered to “double-check” a suspicious email, they become your strongest firewall.
In today's environment, these services aren't “nice-to-haves”—they are investments that help protect the continuity of your business.
As cybersecurity threats continue to grow across Hawaii, ProService is also expanding how it helps employers manage operational risk through a new partnership with local cybersecurity firm Cypac. Learn more about the ProService + Cypac cybersecurity partnership.
The Bottom Line
Cybercrime in Hawaii is no longer a “rare” event or a technical glitch. It is a core operational risk. While we cannot avoid the threat, most of the losses currently hitting Hawaii businesses are preventable through better operational controls, proactive managed security, and heightened awareness.
Want to reduce HR burden and better manage business risk?
ProService helps Hawaii businesses simplify HR and equips them with the tools, resources, and protections needed to navigate today’s risks.
→ Talk to Sales
Important Disclaimer
Statistics provided are editorial estimates based on historical trends and reported data from the FBI IC3 and local law enforcement. Actual figures may vary based on reporting rates and finalized annual government reports.
