Discord, the popular voice and text communication platform widely used by gamers, has confirmed a data breach that exposed official identification documents belonging to thousands of users.
The incident, first disclosed on October 3, was further detailed in an update released on October 8, in which Discord revealed that approximately 70,000 users around the world were affected.
Breach Originated from Third-Party Support Provider
According to Discord, the vulnerability did not originate from its own systems, but rather from a third-party customer support provider. The company did not disclose the name of the vendor but stated that it has since terminated its partnership following the incident.
Hackers reportedly gained access to the provider’s support system for around 58 hours on September 20, after compromising an employee’s account.
What Was Stolen?
The stolen documents were reportedly those submitted for age verification, a process required by law in certain countries. These files included driver’s licenses, passports, and other forms of official identification.
While Discord claims that 70,000 users were impacted, independent reports suggest a much larger scale. The cybersecurity group vx-underground claimed that the attackers obtained 1.5 TB of image data related to age verification and that as many as 2.1 million users may have been affected.
In a statement to Bleeping Computer, the hackers took credit for the attack and claimed to have stolen 1.6 TB of data after breaching Zendesk, a well-known customer support platform. Zendesk, however, denied being compromised, stating that its systems were not involved in the Discord breach.
Cybercriminals further alleged that they had accessed 521,000 age verification tickets in total.
Discord Responds: “Numbers Are Inflated”
Discord has disputed the attackers’ claims, stating that the reported figures are exaggerated. The company emphasised that it will not pay any ransom or engage with those responsible for the attack.
In an official statement, Discord said that it had reviewed all impacted systems, cut ties with the affected support provider, and continues to treat user data protection as a top priority.
The company confirmed that the exposed information includes:
- IP addresses
- Usernames and email addresses
- Partial payment data, such as the last digits of credit cards
All affected users have been notified individually by Discord’s support team.
