Following up on a Linkedin post about non-existent security incidents showing up at the Maine Attorney General's list of consumer data breaches, the Maine AG sent me a statement acknowledging that several recent data breach notices that went live on their site were false reports. One notice said Discord had experienced an insider breach affecting more than 10 million people. Another said VRChat had a breach affecting 2.5M people. Both were hoaxes, apparently.

"The Office of the Maine Attorney General has been made aware of an apparent abuse of our data breach reporting system. After conversations with VRChat, one of two affected companies, it has become clear that the reported data breaches were hoaxes submitted by an unknown entity unrelated to either company. These false reports have been removed from the database. We have no knowledge of any recent legitimate data breach reports from either VRChat or Discord.

We are reviewing our procedures to make this abuse less likely in the future while preserving the public availability of such information. The public-facing database will remain offline until then. In the interim, if you are an entity who needs to submit a data breach report, you can continue to do so through our online reporting service. If you need information from existing reports, please contact us at [email protected]."

https://www.maine.gov/ag/news-and-library/press-releases/statement-office-maine-attorney-general-abuse-data-breach-reporting

https://www.linkedin.com/feed/update/urn:li:activity:7470883943907639297/