Check the sender address. On October 21, 2026, Connecticut Secretary of the State Stephanie Thomas warned businesses about a malicious email that claims to come from her office's Business Services Division. Real emails from the office end in @ct.gov, and any filing can be made by going directly to Business.CT.gov.
At a glance
| Item | What the Secretary of the State says |
|---|---|
| Date of warning | October 21, 2026 |
| Who issued it | Connecticut Secretary of the State Stephanie Thomas |
| Email subject line | "RE: Connecticut Office of the Secretary of the State, Business Services Division" |
| What the email asks | Download an attachment and enter an access code in a "DocuSafe Secure Portal" |
| Official advice | Do not respond, click links or open attachments |
| Where to file | Business.CT.gov, by logging in directly |
Source: Secretary Thomas warns businesses of phishing email, October 21, 2026.
What does the fake Connecticut Business Services email say?
The subject line is "RE: Connecticut Office of the Secretary of the State, Business Services Division." The email claims a secure document has been shared with the recipient. It tells the reader to download an attached file and enter a provided access code to unlock the document through a "DocuSafe Secure Portal."
The Secretary of the State says this type of phishing attack can trick users into revealing sensitive information, including login credentials, or expose their devices to malware. The office asks businesses not to respond to the email or open its attachments.
Source: Connecticut Secretary of the State announcement.
How can you tell a real Secretary of the State email from a fake one?
The office gives these checks:
- Look at the domain. Emails from the Office of the Secretary of the State always come from an address ending in @ct.gov.
- See the real sender. Standard email apps let you hover over or click the "from" address. If it does not end in @ct.gov, the email is not from the state.
- Watch for lookalikes. The office warns that criminals use very similar addresses, such as @cct.gov or @ct-gov.org, and says to stay suspicious even when an email appears official.
The office adds that it cannot prevent these attacks, so its best defense is an informed public.
Source: Connecticut Secretary of the State announcement.
How do you file safely for a Connecticut LLC?
The announcement says all official business filings can be done by going directly to Business.CT.gov and logging in. If a link looks suspicious, even in an email from @ct.gov, do not click it. The Business Services Division may include quick links for convenience, but it is never necessary to click a link to make a business filing.
It also says never to give your Business.CT.gov credentials to anyone, and to turn on multi-factor authentication (MFA), a second sign-in step such as a code from an app, for added security.
For Connecticut formation steps and fees, see the Connecticut LLC guide. The 50-state and DC cost table compares filing costs across states, and the LLC cost calculator estimates state costs for your plan.
Source: Connecticut Secretary of the State announcement.
Frequently Asked Questions
Is the Connecticut Secretary of the State email about a "DocuSafe Secure Portal" real?
No. The Secretary of the State warned on October 21, 2026 that the email is malicious and not from its Business Services Division. The office says businesses should not respond to it or open its attachments.
What domain do real Secretary of the State emails use?
The office says its emails always come from an address ending in @ct.gov. It also warns that criminals use lookalike addresses, such as @cct.gov or @ct-gov.org, so check the ending character by character.
Do I ever need to click a link to make a Connecticut business filing?
No. The office says all official business filings can be done by going directly to Business.CT.gov and logging in, and that it is never necessary to click a link to make a filing.
What should I do if I get this email?
Do not respond to it, click any links in it or open its attachments. The Secretary of the State also says never to give your Business.CT.gov credentials to anyone and to turn on multi-factor authentication (MFA) for added security.
What can a phishing email like this do?
The Secretary of the State says this type of attack can trick users into revealing sensitive information, including login credentials, or expose their devices to malware.