Secretary Thomas Warns Businesses of Phishing Email Impersonating Connecticut Business Registry

(Hartford, Connecticut) — Secretary of the State Stephanie Thomas is warning all Connecticut businesses to avoid a malicious email circulating that claims to be from the Connecticut Business Registry. Do not click on the links.

The email contains a malicious DottedSign link that prompts the user to view and sign a digital document. This technique tricks users into revealing sensitive information to cybercriminals, which can include login credentials, money transfers, or the download of malware.

"Cybercriminals are getting more sophisticated, and it’s critical that businesses stay alert," said Secretary Thomas. "Our office will never send unsolicited documents for signature. If something feels off, trust your instincts and verify before you click."

How to Identify and Prevent Attacks

Unfortunately, our office cannot prevent these types of attacks. Our best defense is an informed and vigilant public.

Official Emails: Emails from the Office of the Secretary of the State will always come from a @ct.gov email address.

Verify the Sender: All standard email applications allow recipients to see the real sender by hovering over or clicking on the "from" address. If this process reveals an address that is not @ct.gov, the email does not come from the state and should not be trusted.

Be Careful with Lookalike Domains: Hackers are sophisticated. While checking the email address is essential, you must remain suspicious even if the email appears to be official. Criminals can trick you by using a very similar-looking address (like @cct.gov or @ct-gov.org), hoping you won't notice the small difference.

Key Security Reminders

Do not respond to or click any links in an email you suspect is malicious.

All official business filings can be accomplished by going directly to business.ct.gov and logging in. If you are suspicious of a link, even in an email from @ct.gov, do not click it. While the Business Services Division may include quick links for convenience, it is never necessary to click a link to make a business filing.
Never give your business.ct.gov credentials to anyone and turn on Multi-Factor Authentication (MFA) for added security.

If something feels off and you need to validate the authenticity of a communication from the Office of the Secretary of the State, contact our Business Services Division at bsd@ct.gov.

###

Contact: Matthew Clyburn
Matthew.Clyburn@ct.gov
(959) 274-6725