VRChat says somebody faked a breach notice with the Maine AG's office

VRChat was the subject of a reported “Notice of Data Incident” filed with Maine’s attorney general claiming a cloud compromise between May 10–12 that exposed data for 2,436,782 users (usernames, emails, VRChat+ status, login histories including device/hardware identifiers and IPs, and Steam/Meta IDs). VRChat told reporters the notice was fake, that the cited employee/email did not exist, and stated it has no reason to believe its systems or data were compromised; the company says it contained any intrusion, engaged outside security experts, and is contacting Maine’s AG to have the false notice removed.