Maine AG: Data Breach Public Database Offline Amid Abuse Review

• Maine's public data breach database, containing reports from August 2010 to September 2020, is currently offline.
• The shutdown is a direct response to an apparent abuse of the state's data breach reporting system.
• New data breach reports can still be submitted through the Maine Attorney General's online service.
• Entities needing historical breach information must now contact the AG's Consumer Protection Division directly via email.
• Maine law mandates certain businesses to investigate and report security breaches involving specific types of personal data without delay.

Legal and compliance professionals in Maine seeking historical data breach reports will now need to contact the Attorney General's office directly, as the public-facing database has been temporarily taken offline.

The Maine Attorney General's public-facing database, which previously provided access to data breach notices, has been temporarily taken offline. This repository contained reports spanning from August 1, 2010, through September 14, 2020. The decision to remove the database from public access follows the discovery of what officials described as an apparent abuse of the state's data breach reporting system.

The Attorney General's office is currently undertaking a review of its internal procedures. The objective of this review is to implement measures that will mitigate the likelihood of similar abuses occurring in the future, all while striving to maintain the public availability of such critical information. The database will remain inaccessible to the public until these procedural enhancements are fully implemented.

For entities that need to access information from existing, historical data breach reports, the interim solution requires direct contact with the Attorney General's office. Inquiries for such data should be directed via email to AG.ConsumerProtectionDivision@maine.gov. It is important to note, however, that the online service for submitting new data breach reports remains fully operational and unaffected by this temporary shutdown.

Maine's comprehensive data breach notification law mandates that specific businesses and organizations report data security breaches to the Office of the Attorney General. These entities are required to utilize the state's dedicated online security breach reporting service for their submissions. The law specifically applies to businesses and organizations that maintain computerized personal data, encompassing sensitive information such as social security numbers, driver's license or state identification numbers, and credit or debit card numbers.

Upon discovering a breach, the affected entity must first conduct a thorough investigation. This investigative phase involves identifying all individuals who may have been impacted by the breach and determining how their information might have been compromised or used. Following the investigation, the breach must be reported to the Attorney General's office without undue delay.

An important provision within the Maine data breach reporting system addresses situations where a criminal investigation is underway. In such cases, reporting entities are advised to consult with law enforcement officials to ensure that the public notification of the breach does not impede or compromise the ongoing investigation. Once law enforcement confirms that the notice will not interfere, the reporting entity is then required to submit the breach notification within seven days.

The temporary unavailability of the Maine AG data breach public database means that legal and compliance professionals, as well as other interested parties, can no longer independently research historical breach data online. This shift necessitates a direct communication channel with the Attorney General's office for any inquiries regarding past incidents, potentially adding an extra step to due diligence processes or compliance checks.

Despite the public database being offline, the Maine AG data breach reporting service continues to function for new submissions. This ensures that businesses and organizations can still meet their Maine data security breach requirements by promptly reporting any new incidents as mandated by law. The reporting service is exclusively intended for authorized agents of the business or organization that experienced the breach, not for individual consumers.

Consumers who have received notification of a data breach or have experienced identity theft are directed to a separate resource. They should not use the business reporting service but instead visit the Attorney General's Identity Theft page for guidance and steps to prevent or address identity theft. The Attorney General's office emphasizes its commitment to reviewing and strengthening its procedures to safeguard the Maine data breach reporting system, with the ultimate goal of restoring public access to breach information while preventing future misuse.

Lawyers and compliance officers in Maine needing to access historical data breach reports will now need to contact the Attorney General's office directly, as the public-facing database is temporarily offline due to system abuse. New breach submissions, however, can still be made via the online reporting service.

Source: Original reporting via the Maine Attorney General's Office