HackingCustomer Data InvolvedPIIIDENTITY_BASICMETADATAHighContained
VRChat, Inc.
bd_d0326c526c80d8c3 · schema v1 · pii pii-v1
Full breach record for VRChat, Inc. →VRChat, Inc. reported an external system breach (hacking) affecting approximately 2.4 million users, including 8,607 Maine residents. Unauthorized access occurred between May 10 and May 12, 2026. Impacted data included usernames, email addresses, subscription status, login history, and linked Steam/Meta IDs. Passwords and payment information were not compromised. VRChat contained the access, engaged forensic experts, and implemented enhanced security controls. Consumer notifications were sent on June 12, 2026.
Maine clockDiscovered May 12, 2026 → Filed with AG Jun 10, 202629d ✓ ME AG ≤30d29 days discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,436,782 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/d52376c9-17af-4c12-8cde-592d1bec2912.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 10, 2026
- Raw hash
- fb4573c536b71639dbb413bc5451061013326ec77ca992f6b52f85919e2b6030
Reporting entity
- Name
- VRChat, Inc.norm: vrchat
- Domain
- vrchat.com
Victim entity
- Name
- VRChat, Inc.norm: vrchat
- Domain
- vrchat.com
Incident
- Discovered
- May 12, 2026
- Materiality determined
- —
- Notification sent
- Jun 12, 2026
- Affected individuals
- 2,436,782
- Data types
- PIIIDENTITY_BASICMETADATA
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 29 days(29 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 29d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: May 12, 2026→ Filed with AG: Jun 10, 202629d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.