The state of Maine has temporarily taken down its public data breach notification portal after malicious actors submitted fraudulent breach disclosures, impersonating well-known technology companies. The false reports were publicly posted before their authenticity could be verified, leading the named companies to deny any breach had occurred.
The incident involved two companies: Discord, a popular messaging platform, and VRChat, a multiplayer social virtual reality platform. The fraudulent notification for Discord claimed that 10 million users were impacted by a data breach. However, this filing contained several red flags, including a Gmail address for contact, a placeholder phone number, and an unrealistic consumer notification date of January 1, 2000. It also lacked a standard component of legitimate filings: an example notification letter to affected customers.
A second, more convincing fake notice targeted VRChat. This filing alleged that hackers had accessed the company's cloud environment in May, exposing the data of over 2.4 million users. The fabricated notice listed compromised data such as usernames, email addresses, VRChat+ subscription status, login history, device identifiers, IP addresses, and linked Steam or Meta account IDs. This notification was submitted under the name "Scott Caruso" using a VRChat email address that does not exist.
Charles Tupper, Head of Community at VRChat, confirmed the notification was fraudulent, stating that VRChat did not submit it and the cited employee and email address are not real. He added that the company has no reason to believe its data or systems have been compromised. The office of the Maine Attorney General also confirmed it had no knowledge of any recent legitimate data breach reports from either VRChat or Discord.
Investigations suggest the system's vulnerability stemmed from a lack of a proper verification mechanism. The Maine data breach reporting system allowed anyone to submit a breach notification form, which would then be added to the portal website without any verification process. This enabled malicious actors to potentially cause reputational damage to companies by submitting seemingly legitimate, yet fabricated, breach notices.
The portal has been temporarily disabled to allow for a review of its procedures and to implement measures to prevent future abuse. The false reports concerning VRChat and Discord have been removed from the portal. It remains unknown who was responsible for the false submissions or whether the targeted companies were chosen deliberately. There is also uncertainty about how many other fraudulent breach notices, if any, might have been submitted before public access was suspended. The state hopes to enhance the portal's security when it is brought back online, as such services are relied upon by journalists and the public to disseminate information about data breaches.
