MAINE’S Attorney General has temporarily taken the state’s data breach reporting portal offline after two hoax filings claimed massive compromises at VRChat and Discord according to an official statement. The false reports alleged that 2.4 million VRChat users and 10 million Discord users had been affected, although both companies said no breach had occurred.
The portal had logged nearly 6,000 breach notices since mid‑2020 and required organisations to disclose the total number of individuals impacted nationwide as noted in industry coverage. The fraudulent submissions exploited this self‑service process, inflating the scale of the alleged incidents to attract attention. Both VRChat and Discord confirmed the allegations were baseless and that their systems remained secure.
No CVEs or identified threat actors are associated with the hoax, but the incident underscores how breach reporting mechanisms can be abused as highlighted by security analysts. The United States recorded a record number of data breaches last year, prompting tighter scrutiny of notification programmes across the country.
State officials said they are reviewing validation procedures to prevent similar misuse while keeping historical breach data accessible through direct contact with the consumer protection division per the Attorney General’s notice. The portal is expected to return once additional safeguards are in place.
Organisations should monitor for spoofed breach notices that misuse their brand and be prepared to issue rapid clarifications to limit misinformation as advised by industry commentators. Maintaining a verified point of contact with state agencies can help confirm the legitimacy of incoming reports.
Regulators might consider adding multi‑factor authentication or moderation steps for submissions, and security teams should keep logs of breach reports to spot abnormal patterns early according to recent guidance. These measures can help preserve the integrity of breach notification systems while still encouraging timely disclosure.