SAN JUAN, Puerto Rico (AP) — An online scam that targeted Puerto Rican agencies attempted to steal more than $4 million, police said Thursday, deepening concerns about the management of local government finances during an economic crisis.

Authorities have frozen at least $2.9 million, said an official who was not authorized to comment on the case and requested anonymity. The government has not said how much money was seized by the hacker.

The scam began when someone hacked into the computer of a finance worker at the island’s Employee Retirement System in December, said José Ayala, director of the fraud unit within the bank robbery division. The hacker then posed as the female employee and sent emails to various government agencies alleging a change in bank accounts, he told The Associated Press.

Two agencies fell victim to the scam in recent months: Puerto Rico’s Industrial Development Company sent $63,000 in December and more than $2.6 million in January, while the island’s Tourism Company sent $1.5 million in January to fraudulent accounts on the U.S. mainland, he said.