DisclosureLens
Feed News/Feed status · Montana AG

Montana's Breach Feed Vanished Behind a Bot Wall for Six Weeks. It's Back.

A zone-wide Cloudflare challenge locked every automated reader out of Montana's breach portal in June. Six weeks later we cleared it with a stealth browser — and never lost a filing.

By DisclosureLens · July 24, 2026
RestoredSource: state_ag_montana
Last capture
July 22, 2026
Poller
0 failed runs
Holdings
6,608 records
Last checked
July 31, 2026 · succeeded

The badge and figures above are read live from /v1/health/sources on each render. Weekday poll (16:30 UTC, Mon–Fri) through a stealth browser; the collector loud-fails the moment the challenge re-hardens.

Montana doesn't file many breaches — a handful a week — but it files them in the open, on a plain Department of Justice web page. In mid-June that page stopped answering us. Not a 404, not a redirect: a Cloudflare 'Just a moment…' interstitial that every automated client on earth is built to fail.

What happened. Around June 11, dojmt.gov switched on a zone-wide Cloudflare managed challenge — the JavaScript puzzle a real browser solves invisibly and a script cannot. It made no difference which user-agent we sent or which address we sent it from; a residential IP drew the same 403 as a datacenter one. This wasn't the crude IP block we've hit at other sources. It was bot-detection that fingerprints the browser itself, and our collector — a well-behaved HTTP client — failed it by design.

Why it was hard. You can't header your way past a challenge like this. The check runs real JavaScript and inspects the browser's own fingerprint, so the only honest way through is to be a real browser — and even a plain headless Chromium gives itself away the moment the page loads.

How we got back in. We rebuilt the Montana fetch on a stealth-hardened headless Chromium: automation flags off, the tell-tale automation signal masked, a genuine user-agent. It clears the challenge the way a person's browser would — reproducibly, from the same datacenter the poller runs in. Montana came back online in our feed on July 22, six weeks after it went dark, and the first recovered poll pulled three fresh filings (Murex Petroleum, TriZetto, Lumexa Imaging).

What we held. Nothing was lost in the gap. Montana files a few notices a week, we already held 6,605 of them, and the portal's newest filing when it went dark was about four weeks old. Today we hold 6,608 Montana records and the source is back on its normal daily cadence.

How we're watching. Montana is off our known-dark list and back in active monitoring, where a real outage can page us again. The fix is a technique, not a truce — clearing a managed challenge is an arms race — so if Cloudflare hardens it again our collector fails loudly instead of quietly parsing a puzzle page, and we'll know on the next scheduled poll.

Update log

  1. July 22, 2026
    Restored

    Montana is back in our feed. A stealth headless-browser fetch clears the Cloudflare challenge from the poller's own datacenter IP; the first recovered poll pulled three new filings (Murex Petroleum, TriZetto, Lumexa Imaging). Removed from the known-dark list and returned to active monitoring.

  2. June 11, 2026
    Dark

    Montana's DOJ breach portal went behind a zone-wide Cloudflare challenge; every automated reader began drawing a 403. The poller loud-failed on each run rather than parse the challenge page.

DisclosureLens tracks the state of every source it collects, not just the records. When this feed changes — restored, relocated, or gone for good — we log it here and notify subscribers. Browse the preserved per-state archives under /breach-notifications.