At 11:20 this morning, an email landed in inboxes across the Braddock District from an address residents have every reason to trust: a senior staff aide to their county supervisor, writing from a fairfaxcounty.gov account. It was polite. It was well-formatted. It offered a document “securely shared through Adobe Document Cloud,” behind a link marked ACCESS FILE. It asked the reader to download the file and “grant any required permissions.”

It was a fake.

Within hours, Braddock District Supervisor Rachna Sizemore Heizer’s office sent a Braddock Alert telling residents not to open it, not to click it, and to enter no passwords if they already had. The office says it is “investigating the possibility that our employee’s account may have been hacked.”

Give the office this much: the warning went out the same day. That is faster than most governments manage.

Now the harder part.

Scroll to the bottom of the fraudulent email and you’ll find the county’s standard disclaimer, pasted in faithfully by whoever was operating that account. Correspondence with supervisors is subject to the Virginia Freedom of Information Act — but the county “may withhold your personal contact information,” which it defines as “your home or business address, email address, or telephone number.”

That is a promise Fairfax County makes to every resident who writes to their supervisor. Write to us, and we’ll shield your address and your phone number from public release.

That promise lives in one place: the mailbox. This morning, a criminal may have been standing in it.

Think about what a supervisor’s senior aide keeps in a sent folder. Constituents writing about the zoning fight next to their house. A neighbor complaining about a neighbor. Someone asking for help with a county agency and explaining, in detail, exactly why they need it. Names, home addresses, cell numbers — the precise information the county’s own FOIA language promises to protect.

So Braddock residents are owed three answers, and not next month.

How many people received it, and who were they? A blast from a compromised mailbox goes to the contact list. That list is constituents.

Was anything accessed or taken? “Investigating the possibility” is a statement about an account. It is not a statement about the data inside it.

Has anyone outside Braddock been told? If a fairfaxcounty.gov address was used to send fraud this morning, that is not a Braddock problem. That is a Fairfax County problem, and there are eight other districts.

The staff aide whose address was on that email is not the villain here. Phishing works on competent people — that is the entire business model, and anyone who thinks it couldn’t happen to their office is next. The question was never whether one aide clicked something.

The question is whether Fairfax County’s word — we’ll protect your contact information — was ever backed by anything more than a mailbox and a hope.

Residents will find out either way. The county should be the one to tell them.