Summary

• A false Maine filing claimed unauthorized access to VRChat's cloud environment and exposure of data tied to more than 2.4 million users.
• VRChat said it did not submit the notice, the named employee and email address were fictitious, and it had no evidence of a compromise.
• The notice listed usernames, emails, account and subscription details, IP addresses, device information, and login history, but excluded passwords, payment data, and age-verification documents.
• Maine officials said submissions could be posted before independent validation and later described the VRChat and Discord filings as hoaxes.
• The public-facing Maine breach portal was temporarily taken offline while officials reviewed procedures to limit abuse.
• The incident illustrates how official publication can amplify fraudulent breach claims and cause confusion before verification occurs.