Maine's breach-notification portal abused for fraudulent filings against VRChat and Discord, both companies deny any breach
Analysis
Maine's Attorney-General breach-notification portal published fraudulent data-breach filings (one claiming a 2.4-million-user VRChat cloud compromise, another a 10-million-user Discord breach) because submissions are published without filer-identity verification (BleepingComputer, 2026-06-11). VRChat stated: "VRChat did not submit this Notice of Data Incident, and the employee/email cited does not exist. We have no reason to believe that our data or systems have been compromised." Discord likewise denied filing. The Maine AG's office acknowledged the fraudulent notices and moved to remove them. [SINGLE-SOURCE, BleepingComputer.]
Why it matters to us: CTI teams routinely treat state breach portals as authoritative collection sources; this incident shows they can be poisoned. Require victim confirmation or regulator follow-up before acting on (or republishing) portal-only breach claims; the same trust-exploitation pattern would work against any unauthenticated notification channel.
Updates1
The Maine Attorney General's Office issued a formal statement on 12 June confirming that the VRChat and Discord breach filings surfaced through its public portal were hoaxes submitted by an unknown entity unrelated to either company, and that it has no record of any recent legitimate breach reports from either (Maine AG, 2026-06-12).
The office took the public-facing breach database offline while it reviews and hardens its submission procedures (BleepingComputer, 2026-06-12). The material delta on yesterday's coverage is the regulator's own confirmation that the filings were fraudulent and the portal's suspension; a reminder that self-certification breach portals are an unauthenticated data-integrity surface, and that breach "disclosures" sourced solely from such portals warrant corroboration before action.
Sources3
Revision history
- Published 2026-06-12-5ab9a319
- Update 2026-06-13-40b26572
UPDATE (originally covered 2026-06-12): The Maine Attorney General's Office issued a formal statement on 12 June confirming that the VRChat and Discord breach filings surfaced through its public portal were hoaxes submitted by an unknown entity unrelated to either company, and that it has no record of any recent …
Changed: sectors sources tags body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.