Maine's public data breach reporting portal was abused by an unknown entity submitting fraudulent breach disclosures impersonating companies such as Discord and VRChat. These fake disclosures were automatically published on the state's website without independent verification, causing misinformation and potential reputational harm. Upon discovery, the Attorney General's Office removed the false entries and temporarily disabled public access to the breach notification database. The office is reviewing reporting procedures to prevent similar abuse. Legitimate breach submissions can continue, but public requests for disclosures must be handled directly by the Attorney General's Office.

The automatic publication of unverified breach disclosures allowed attackers or malicious actors to spread false information, potentially damaging the reputation of targeted companies. This abuse undermines the trustworthiness of the state's breach notification system and could mislead journalists, researchers, and the public relying on the portal for accurate breach information. No actual breaches of the impersonated companies were confirmed.

The Maine Attorney General's Office has temporarily disabled public access to the breach notification portal and removed fraudulent disclosures. They are reviewing and updating reporting procedures to prevent abuse of the system. Companies can still submit breach notifications, but public access to disclosures now requires contacting the Attorney General's Office directly. No further immediate action is required by external parties until the portal is reinstated with improved safeguards.