A widely used data breach reporting portal published by the state of Maine was closed to the public after two fake breach notices were posted.

One of the bogus notices appeared on Thursday under the name of a nonexistent VRChat employee and reportedly claimed 2.4 million customers of the virtual reality social platform were breached.

The breach report was submitted on fake VRChat letterhead, the company said. A fake breach notice also was posted for Discord.

Maine is still allowing companies to report breaches, but won’t make the portal easily available to the public until after it completes an audit of its procedures to stop such incidents, according to a press release from the Maine attorney general’s office.

Members of the public can contact the office to inquire about “existing reports” of breaches, the press release said.

Calling the notices “hoaxes,” the press release said the fake reports have been removed and that the office has “no knowledge of any recent legitimate data breach reports” from either company.

“We are reviewing our procedures to make this abuse less likely in the future while preserving the public availability of such information,” the press release said. “The public-facing database will remain offline until then.”

The Maine reporting portal has been a valuable resource for security researchers, reporters and companies working in threat intelligence and lack of public access to it could have an impact on those communities.

The portal was easy to abuse — it has historically allowed companies to add notices to the site without review.

Additional fraudulent notices may have been posted, but Maine only announced Discord and VRChat as victims.

VRChat issued a statement saying that Maine was not quick to respond to its request that the fake notice be removed.

“Despite our best efforts, this notice remained up for several hours,” the statement said. 

“We want to make it perfectly clear that we have no reason to believe that our data and systems were compromised, and we did not submit any official notice about a data breach.”

News of the fake posting was first reported by Bleeping Computer.

VRChat and Discord did not respond to requests for comment.