You could file a fake data breach against any company on Maine's official portal. Someone finally did
Source Reddit BlueTeam
Discussion
Maine's official data breach notification portal allowed anyone to submit breach disclosures without verification, leading to fake breach reports being publicly posted. Notably, fraudulent notices impersonating Discord and VRChat were submitted, causing these companies to publicly deny the incidents. The portal has been taken offline while the Maine Attorney General's office reviews the situation. This lack of authentication in the submission process risks misinformation, reputational damage, and public panic.
r/Information_Security (opens in a new tab)u/Syncplify0 points0 comments
Maine runs an official portal where companies report data breaches to the public. Turns out anyone could submit a notice with no verification whatsoever, and someone figured that out and used it to post fake breaches impersonating Discord and VRChat before a single person thought to check if they were real.
The Discord filing claimed 10 million users had been affected and listed a Gmail address as the contact, a placeholder phone number, and a customer notification date of January 1st, 2000. Nobody caught it. The VRChat one was more convincing, with a detailed list of exposed data types and a fake employee name, and still made it through without a single check.
Both companies had to come out publicly and confirm nothing had actually happened. The portal is offline now while they figure out what to do, but the uncomfortable question is how many other fake notices made it through before this one got caught, especially since journalists regularly rely on these portals to report on real breaches to the public. Who signed off on a public breach notification system with zero authentication and thought that was fine?