The Maine Office of the Attorney General disclosed a data breach affecting Vaporfi.com (and its associated platform, Directvapor.com) on December 21, 2020. The incident stemmed from unauthorized access to the company’s online payment platform, discovered on September 23, 2020. The breach exposed credit and debit card information of 10,544 individuals, including 3 Maine residents. While the exact method of intrusion remains undisclosed, the compromise of financial data suggests a targeted cyber intrusion aimed at exploiting payment processing vulnerabilities. The exposed information poses risks of fraudulent transactions, identity theft, and financial losses for affected customers. The breach underscores the critical need for robust payment system security, particularly in e-commerce platforms handling sensitive financial data. No evidence suggests broader data exfiltration beyond payment details, but the incident highlights vulnerabilities in third-party payment integrations or internal security controls.

The California Office of the Attorney General reported a data breach involving International Vapor Group on March 12, 2019. The breach occurred on June 30, 2018, resulting in the compromise of customers' names and credit or debit card information due to unauthorized access to their e-commerce site.