An age-verification appeal can create a sensitive record far outside the chat a person signed up to use. Discord’s October 2025 incident notice said attackers compromised a customer-support provider and accessed some users’ support information.
Discord said the records could include contact details, limited billing information, support messages, and government-ID images. It said passwords and full credit card numbers were not involved. It revoked the provider’s access to its ticketing system.
Later disclosure: Discord updated the notice on October 9, 2025, saying approximately 70,000 users worldwide might have had government-ID photos exposed. That is more informative than the original “small number” wording. The records came from age-related appeals, not every Discord conversation.
Collecting an ID creates work that outlasts the check
An ID image remains useful to an attacker after the platform finishes the appeal. Changing an account password cannot retrieve a copied photograph. I would want the service to explain how long it retains that image and which providers can reach it.
Outsourcing support changes who performs the work. It does not remove the platform’s responsibility to decide what its contractors can see. Ticket access should match the job, and sensitive attachments need their own retention and access controls.
Discord said it notified affected users by email and identified whether an ID might have been accessed. This dated post records that response. The broader product question survives it: if a platform needs proof of age, how little identifying material can it keep once the decision is made?