Maine removes its data breach notification portal after being flooded with false claims

Maine AG’s breach reporting portal abused with fake notifications impersonating Discord and VRChat
False reports submitted through the public intake system; hoaxes later confirmed and deleted
Portal taken offline for investigation, businesses still able to file complaints, but public access suspended

The Maine Attorney General’s Office was forced to take its reporting portal offline after several false disclosures ended up on the website.

The Breach Notification Portal is a public system for receiving legally required data breach notifications. So, if an organization experiences a breach affecting Maine residents, they can submit their notification through this portal instead of sending an email or postal mail. Once submitted, the Attorney General’s Office reviews the notice and typically publishes it, so the public can see confirmed incidents affecting residents.

However, recently fraudulent disclosures impersonating Discord and VRChat have found their way onto the platform, with the latter having to issue a statement saying the case was submitted using a fake employee name.

Disable the portal

Shortly after, the Maine AG’s office confirmed the reports, saying the counterfeits were submitted through the state’s reporting system.

“The Maine Attorney General’s Office has been made aware of an apparent abuse of our data breach reporting system,” the statement said.

“After conversations with VRChat, one of the two affected companies, it became clear that the reported data breaches were hoaxes submitted by an unknown entity with no connection to either company. These false reports have been removed from the database. We are not aware of any recent reports of legitimate data breaches from VRChat or Discord.”

To prevent similar abuses in the future, the Maine AG’s office has launched an investigation and temporarily disabled public access to the portal.

“We have no independent knowledge of the violations, the entity submitting them fills out the information and it is posted directly to the site. We will look into the one you reported, thank you,” the Maine Attorney General’s office said. BeepComputer.

Businesses can still submit breach notifications through the reporting service, but the general public seeking information will need to contact the Office directly.

Via BeepComputer