- Maine AG’s breach reporting portal abused with fake notices impersonating Discord and VRChat
- False reports submitted via public intake system; later confirmed hoaxes and removed
- Portal taken offline for investigation, with companies still able to file but public access suspended
The Office of the Maine Attorney General has been forced to pull its reporting portal offline after multiple fake disclosures ended up on the website.
The breach notification portal is a public intake system for legally required data breach notices – so if an organization suffers a breach that affects Maine residents, it can submit its notification through this portal instead of sending an email or snail mail. Once submitted, the Attorney General’s office reviews the notice and usually publishes it, so the public can see confirmed incidents affecting residents.
However recently, fraudulent disclosures impersonating Discord and VRChat ended up on the platform, with the latter having to issue a statement saying the filing was submitted using a fake employee name.
Disabling the portal
Soon after, the Maine AG Office confirmed the reports, saying the fakes were submitted through the state’s reporting system.
“The Office of the Maine Attorney General has been made aware of an apparent abuse of our data breach reporting system,” it was said in the statement.
“After conversations with VRChat, one of two affected companies, it has become clear that the reported data breaches were hoaxes submitted by an unknown entity unrelated to either company. These false reports have been removed from the database. We have no knowledge of any recent legitimate data breach reports from either VRChat or Discord.”
To prevent similar abuse in the future, the Maine AG Office launched an investigation and temporarily disabled public access to the portal.
