Maine's official data breach notification portal was abused by malicious actors submitting fraudulent breach disclosures that were publicly posted before verification. The portal accepts submissions from anyone and posts them directly without independent validation. Fake breach notices, including one falsely attributed to VRChat and another to Discord, contained fabricated details and fictitious employee information. The Maine Attorney General's Office confirmed the lack of verification and is taking steps to remove false entries. This misuse of the portal enables misinformation campaigns that can cause reputational damage and public confusion.

The immediate public posting of unverified breach disclosures can lead to misinformation, reputational harm to companies falsely implicated, and potential public panic. Companies may be forced to publicly deny false claims, diverting resources and attention. The lack of submission vetting undermines the reliability of the portal as a trusted source for breach notifications.

The Maine Attorney General's Office is aware of the issue and has stated that false notices will be removed from the portal. Organizations and consumers should independently verify breach notifications with affected companies before accepting them as legitimate. No technical patch is applicable as this is a procedural and platform governance issue. Stakeholders should advocate for improved submission verification processes on the portal to prevent future misinformation.