Discord data breach exposes government IDs of thousands of users

Discord

Discord has confirmed that approximately 70,000 users may have had their government ID images compromised following a breach at a third-party customer service provider. The company revealed the details after reports emerged online claiming that hackers were attempting to extort Discord using stolen data from its Zendesk instance.

A tweet by vx-underground alleged that the attackers had over 1.5TB of data, including more than two million photos used for age verification. In response, Discord spokesperson Nu Wexler told The Verge that these claims were exaggerated and that the actual scale of exposure was significantly smaller.

Wexler said the incident was not a direct breach of Discord’s systems but rather involved a vendor responsible for handling customer service requests. “Of the accounts impacted globally, we have identified approximately 70,000 users that may have had government-ID photos exposed,” Wexler confirmed, adding that Discord would not bow to extortion demands.

The company stated that it has already contacted all affected users and is working with law enforcement, data protection authorities, and cybersecurity experts to assess the situation. The compromised vendor has been removed from Discord’s network, and the affected systems have been secured.

The incident follows last week’s security advisory, which warned that personal information such as names, usernames, email addresses, IP details, and the last four digits of payment cards might have been part of the breach. Discord reiterated its commitment to safeguarding user privacy and assured customers that additional protective measures are being implemented to prevent similar occurrences.

While the incident underscores the risks of relying on third-party service providers for identity verification, Discord’s swift response highlights the company’s growing maturity in handling security challenges. However, the breach also serves as a reminder that even trusted platforms can be vulnerable when external systems are involved.