The Breach Notice Was Fake

We have noticed a significant amount of commentary this week about an alleged data breach at VRChat. We want to make it perfectly clear that we have no reason to believe that our data and systems were compromised, and we did not submit any official notice about a data breach. A false data breach notice was filed on behalf of the company by an unknown third party.

The situation began on Thursday, June 11, when the Maine Attorney General’s office posted a notice indicating that VRChat had suffered a data breach. This notice was reported on by several blogs and other outlets.

Upon inspection, it was apparent that this notice was submitted by an unknown third party. It was drafted on fake VRChat letterhead using the name and contact information of a person who does not exist.

Despite our best efforts, this notice remained up for several hours. Once it was removed, the Maine Attorney General’s Office posted about the situation, declaring the submitted notices as “hoaxes.” (https://www.maine.gov/ag/news-and-library/press-releases/statement-office-maine-attorney-general-abuse-data-breach-reporting)