Discord - Data Breach
Executive Summary
Maine temporarily disabled its public data breach notification portal after fraudulent breach disclosures impersonating Discord and VRChat were submitted and automatically published to the state's website. The fake filings, including one falsely claiming VRChat suffered a breach affecting 2.4 million people, were submitted by unknown parties and have since been removed. The state is now reviewing its reporting procedures to prevent similar abuse, while continuing to accept breach notification...
What Happened
On June 12, 2026, Maine's Attorney General's Office temporarily disabled its public data breach notification portal after discovering fraudulent breach disclosures had been automatically published to the state's website. Unknown parties submitted fake filings impersonating Discord and VRChat, including one falsely claiming VRChat suffered a breach affecting 2.4 million people. The fraudulent submissions used fictitious employee names and were automatically posted to the public database without verification before being identified and removed.
Who Is Affected
Discord and VRChat were directly affected through impersonation and potential reputational harm from the fraudulent filings. Journalists, researchers, and threat intelligence firms who rely on Maine's breach portal to monitor legitimate security incidents temporarily lost access to the public database. Maine residents and the general public seeking information about actual data breaches must now contact the Attorney General's Office directly rather than accessing the previously public database.
Why It Matters
This incident exposes a critical vulnerability in state-level breach notification systems that automatically publish submissions without verification, demonstrating how such systems can be weaponized to spread misinformation and damage corporate reputations. Maine's portal serves as an important transparency tool used across the privacy and security research community, and its compromise undermines public trust in official breach disclosure mechanisms. The event highlights the tension between transparent breach reporting and the need for verification processes to prevent abuse.
What You Should Do
If you are seeking information about a potential data breach affecting your information, contact the Maine Attorney General's Office directly rather than relying on the currently disabled public portal. Verify any breach notifications you encounter through multiple official sources, including direct statements from the affected company, before taking action or sharing the information. If you are a company required to report breaches to Maine, continue submitting notifications through the reporting service as the state reviews its verification procedures.
Summary generated from verified sources and reviewed before publication. How we summarize.