Discord customer service data breach leaks user info and scanned photo IDs
Discord suffered a data breach through one of its third-party customer service providers. An unauthorized party compromised the provider and gained access to information from users who had contacted Discord's Customer Support and Trust & Safety teams. The attackers attempted to extort a financial ransom from Discord.
The breach exposed names, usernames, emails, and the last four digits of credit card numbers. More concerning, the attackers accessed a "small number" of images of government-issued IDs from users who had appealed age determinations. Full credit card numbers and passwords weren't compromised.
Discord is emailing impacted users now. If your government ID might have been accessed, the email will specifically call that out.
The company says the unauthorized party "did not gain access to Discord directly"—the breach happened at the third-party support provider level. Discord has revoked the provider's access to its ticketing system, notified data protection authorities, and is working with law enforcement. The company also reviewed "our threat detection systems and security controls for third-party support providers."
This breach hits differently than your typical username-and-email leak. Government-issued IDs are permanent—you can't just change your driver's license number like you'd rotate a password. When that data gets out, it stays out, and it can be used for identity theft, synthetic identity fraud, or sold on dark web marketplaces.
The "small number" qualifier doesn't make it better. If your scanned ID is in that small number, you're dealing with the full impact of the breach regardless of how many other people got hit.
Discord's reliance on third-party customer service providers created this vulnerability. That's not unique to Discord—lots of companies outsource support operations—but it's a reminder that your data security is only as strong as the weakest link in the vendor chain. When you hand over a government ID to verify your age on a platform, you're trusting not just that platform, but every third-party service provider they use.
The extortion attempt suggests this was a targeted attack, not just opportunistic access. Attackers who go after customer service databases know exactly what they're looking for—verified identity data that's worth real money.
If you've ever contacted Discord support or appealed an age determination, watch for that email and take it seriously. Consider placing a fraud alert on your credit reports if your ID was compromised.
Source: The Verge