VRChat: VRChat says Data Breach notification filed with Maine Attorney General was Fake

Fraudulent Data Breach Notification Targets VRChat, Raising Regulatory Concerns

A recent fraudulent data breach notification filed with the Maine Attorney General’s Office has sparked concerns about a new cybersecurity threat: malicious actors submitting fake disclosures to regulatory agencies. The incident involved VRChat, a widely used virtual reality and social platform, which confirmed that the filing alleging a breach of user data was entirely fabricated.

VRChat’s Head of Community, Charles Tupper, stated that the company had no evidence of the claimed breach and that the notification was fraudulent. Attempts to verify the submission’s contact details including a non-responsive phone number and email address further supported the conclusion that the filing was a hoax. The company has not identified the responsible party.

The incident underscores a growing risk: fraudulent breach notifications could lead to reputational harm, regulatory scrutiny, and confusion among users and partners. Security experts warn that without stronger verification processes, such tactics may become more frequent.

Separately, VRChat has faced scrutiny over a potential security incident in May 2024, where reports suggested its cloud environment was compromised, exposing data linked to approximately 2.5 million users. While the company has not confirmed the full scope of the incident, leaked details allegedly included usernames, email addresses, login histories, and subscriber metadata though no financial or government-issued identification data was reportedly affected. VRChat has since reinforced its security measures in response.

The episode highlights the dual challenges organizations face: defending against actual cyber threats while navigating misinformation and fraudulent disclosures that complicate incident response and public trust.

Source: https://www.cybersecurity-insiders.com/vrchat-says-data-breach-notification-filed-with-maine-attorney-general-was-fake/

VRChat Inc. cybersecurity rating report: https://www.rankiteo.com/company/vrchat

"id": "VRC1781252970",
"linkid": "vrchat",
"type": "Breach",
"date": "5/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '2.5 million users',
                        'industry': 'virtual reality and social platform',
                        'name': 'VRChat',
                        'type': 'company'}],
 'data_breach': {'number_of_records_exposed': '2.5 million',
                 'personally_identifiable_information': 'usernames, email '
                                                        'addresses',
                 'sensitivity_of_data': 'low to moderate (no financial or '
                                        'government-issued identification '
                                        'data)',
                 'type_of_data_compromised': ['usernames',
                                              'email addresses',
                                              'login histories',
                                              'subscriber metadata']},
 'description': 'A fraudulent data breach notification filed with the Maine '
                'Attorney General’s Office falsely alleged a breach of VRChat '
                'user data. VRChat confirmed the filing was fabricated and had '
                'no evidence of the claimed breach. Separately, VRChat faced '
                'scrutiny over a potential security incident in May 2024 '
                'involving a cloud environment compromise exposing data linked '
                'to approximately 2.5 million users.',
 'impact': {'brand_reputation_impact': 'potential reputational harm',
            'data_compromised': 'usernames, email addresses, login histories, '
                                'subscriber metadata',
            'systems_affected': ['cloud environment']},
 'investigation_status': 'ongoing (fraudulent filing), unresolved (potential '
                         'May 2024 breach)',
 'lessons_learned': 'Fraudulent breach notifications can lead to reputational '
                    'harm, regulatory scrutiny, and confusion among users and '
                    'partners. Stronger verification processes are needed to '
                    'prevent such tactics.',
 'motivation': ['reputational harm', 'misinformation'],
 'post_incident_analysis': {'corrective_actions': 'reinforced security '
                                                  'measures'},
 'recommendations': 'Implement stronger verification processes for regulatory '
                    'filings to prevent fraudulent disclosures.',
 'references': [{'source': 'Maine Attorney General’s Office'}],
 'regulatory_compliance': {'regulatory_notifications': ['fraudulent filing '
                                                        'with Maine Attorney '
                                                        'General’s Office']},
 'response': {'remediation_measures': 'reinforced security measures'},
 'title': 'Fraudulent Data Breach Notification Targets VRChat',
 'type': ['fraudulent disclosure', 'potential data breach']}