The US state of Maine has taken its public data breach notification portal offline after someone submitted fraudulent breach disclosures impersonating two well-known technology companies.
As Bleeping Computer reported last week, fraudulent data breach disclosures were submitted to Maine’s official breach portal and publicly posted before their legitimacy could be verified, prompting the named companies to deny the claims.
The first fake notification targeted the popular messaging platform Discord, used by hundreds of millions of people worldwide. The notification, which claimed that 10 million people had been impacted by a data breach, was riddled with clues that should have made anyone question its legitimacy: it included a Gmail contact address, a placeholder phone number, and a consumer notification date of January 1st, 2000.
Furthermore, it lacked an example notification letter to affected customers – something that is standard practice in legitimate breach filings.
However, somewhat more convincing was a fake breach notice that targeted the multiplayer social virtual reality platform VRChat. The filing claimed that hackers had gained access to the company’s cloud environment in May, and the data of more than 2.4 million users had been exposed.
The fabricated VRChat breach notification listed compromised data including usernames, email addresses, VRChat+ subscription status, login history, device identifiers, IP addresses, and linked Steam or Meta account IDs, according to Bleeping Computer.
However, that notification was submitted under the fake name “Scott Caruso” using the email address scaruso(at)vrchat.com.
Charles Tupper, Head of Community at VRChat, confirmed to BleepingComputer that the notification was fraudulent:
“VRChat did not submit this Notice of Data Incident, and the employee/email cited does not exist. We have no reason to believe that our data or systems have been compromised.”
In a statement, the office of the Maine Attorney General confirmed that it had “no knowledge of any recent legitimate data breach reports from either VRChat or Discord.”
So, what had gone wrong?
It appears that the abuse of the system was possible because the Maine data breach reporting system lacked a proper verification mechanism.
Anyone could submit a breach notification form and have it added to the portal website without verification.
Which means that anybody who wanted to cause reputational damage to a company could submit a convincing-looking breach notice and have it published.
The portal has temporarily disabled public access to the breach notification database while it reviews its procedures to reduce the chances of similar abuse in the future. And, of course, the false reports of breaches at VRChat and Discord have now been removed.
It is not currently known who was behind the false submissions, and whether the targets were chosen deliberately or not. Perhaps worryingly, it also remains unclear how many (if any) other fraudulent breach notices may have been submitted through the portal before public access to it was suspended.
Hopefully when the portal is brought back online its security will have been tightened, as many journalists do rely upon services like this to notify the general public about data breaches which occur and companies and organisations.