Maine has shut down its public data breach notification portal after fraudulent breach disclosures were published on the state's website. The move comes as officials review security procedures to prevent further abuse of the system, which companies use to report data incidents as required by state law.
The portal's disabling follows an incident where unauthorized submissions appeared on the site, though the exact nature and volume of the fake filings remain undisclosed. Maine's action highlights ongoing challenges in verifying breach notifications—a critical component of consumer protection—as bad actors exploit reporting channels.
Separately, a bankruptcy administrator has approved a $47 million settlement fund for victims of the 2023 23andMe data breach. The genetics testing company suffered a cyberattack starting in April 2023 that compromised data belonging to approximately 7 million customers, with stolen information later posted on dark web forums.
While the 23andMe settlement represents progress for affected users, the Maine portal incident underscores vulnerabilities in breach reporting infrastructure. No timeline has been provided for restoring Maine's system, and authorities have not confirmed whether the fraudulent filings were linked to broader malicious activity.
Taken together, these events illustrate the complexity of breach response—from ensuring accurate public notifications to compensating victims—as organizations and governments grapple with the aftermath of cyberattacks.