Fake Maine Breach Notices Naming VRChat and Discord Expose Portal’s Lack of Verification
Summary
Fraudulent notices naming VRChat and Discord appeared on Maine’s breach portal, which accepts filings without verification. VRChat denied compromise, and Maine officials said they would remove its notice, highlighting the need to verify public filings.
Key points
- Maine’s Attorney General’s office said breach notices submitted through its portal are posted without independent verification.
- VRChat said it did not submit the notice, the named employee does not exist, and it had no reason to believe its systems or data were compromised.
- The false VRChat filing alleged that data from more than 2.4 million users was exposed and listed account and login information.
- A suspicious Discord filing alleged 10 million people were affected; it included vague details, a placeholder phone number, and inconsistent dates.
- Maine officials said VRChat’s notice would be removed and said they would review the Discord filing.
- The article distinguishes the fake filing from a separate September 2025 Discord Zendesk incident; hackers told BleepingComputer they stole data from 8.4 million tickets.
Article Details
- Event Type
- False data-breach disclosures submitted to Maine’s official breach portal and posted without independent verification.
- Impact
- The false filings claimed that data from more than 2.4 million VRChat users and 10 million Discord users was exposed. Both companies denied the disclosures; the article reports no reason to believe VRChat’s systems or data were compromised. The filings risked spreading misinformation and causing reputational harm and public concern.
People
Charles TupperVRChat’s Head of Community, who said the breach notice was fraudulent, the cited employee and email did not exist, and VRChat had no reason to believe its systems or data were compromised.Graham GaylorVRChat’s CEO and co-founder, who confirmed the statement VRChat provided about the fraudulent breach notice.
Products
DiscordFraudulent breach notices were posted to Maine’s official portal claiming major incidents at VRChat and Discord, but both companies denied the disclosures and said the filings were false.VRChatFraudulent breach notices were posted to Maine’s official portal claiming major incidents at VRChat and Discord, but both companies denied the disclosures and said the filings were false.ZendeskAlthough a data breach did impact Discord in 2025, it occurred on September 20 and was due to a compromise of the company’s Zendesk support desk system.