Maine Attorney General suspends reporting portal following fake breach reports

The Office of the Maine Attorney General has temporarily suspended its data breach reporting database after malicious actors submitted two fake data breaches in the name of victim companies.

 

The Maine Attorney General’s website maintains a list of data breaches reported by organisations where the personal or financial information of Maine residents are compromised. Each data breach report contains the number of affected residents within the state and nationally and contains details of incidents and remediation actions taken by organisations.

 

Recently, malicious actors submitted fake data breach notifications with the Maine Attorney General’s office on behalf of online social platform VRChat and communication platform Discord. The breaches were subsequently reported by news portals worldwide and received significant public reaction.

 

Following the publication of the fake breach report, VRChat issued a public statement on June 12, stating that it did not suffer any breach incident and that the breach report was submitted by a third party.

 

"We want to make it perfectly clear that we have no reason to believe that our data and systems were compromised, and we did not submit any official notice about a data breach. A false data breach notice was filed on behalf of the company by an unknown third party," VRChat said.

 

The fake breach report was published on Maine Attorney General’s website on June 11. VRChat said that the third party drafted the data breach notice on a fake VRChat letterhead and used the name and contact information of a company representative who does not exist.

 

Malicious actors also filed a fake data breach notice on behalf of Discord, stating that the communication platform had suffered a breach that impacted about ten million individuals. The data breach affecting Discord took place in 2025 but had impacted about 70,000 individuals and not ten million people.

 

"After conversations with VRChat, one of two affected companies, it has become clear that the reported data breaches were hoaxes submitted by an unknown entity unrelated to either company," the Maine Attorney General’s office said in a press release.

 

"These false reports have been removed from the database. We have no knowledge of any recent legitimate data breach reports from either VRChat or Discord.

 

"We are reviewing our procedures to make this abuse less likely in the future while preserving the public availability of such information. The public-facing database will remain offline until then. In the interim, if you are an entity who needs to submit a data breach report, you can continue to do so through our online reporting service," it added.