Overview
- The Office of the Maine Attorney General disabled the public-facing breach portal on Monday and removed two hoax reports that impersonated VRChat and Discord.
- One fake filing used counterfeit VRChat letterhead, named a non-existent employee and claimed about 2.4 million users were affected; VRChat said the notice was not genuine.
- A separate notice claimed Discord had a 10 million-user breach but contained clear red flags and no evidence supports that scale; Discord’s prior disclosed incident involved about 70,000 government ID copies.
- Security gaps allowed anyone to submit and publish a notice without firm verification, and the portal had listed nearly 6,000 incidents since mid-2020; organizations can still file reports through the AG’s internal online reporting service.
- The state will keep the public database offline while it considers stronger verification and authentication rules, and the motive and origin of the fraudulent submissions remain under investigation.