A former contractor's account was hacked, state officials said, leading to a widespread phishing campaign emanating from official state email addresses.