Discord security breach leaks users govt ID, payment details: What happened

Discord says one of its third-party support providers was breached, exposing limited user data including names, emails, billing details, and some government ID images

Discord has revealed a data security incident involving one of its third-party customer service providers. The company confirmed that an unauthorized party gained access to information belonging to a limited number of users and attempted to extort money from Discord. The company stressed that its own systems were not directly compromised and that steps were taken immediately to contain the breach.

What happened?

According to Discord, the breach occurred after one of its third-party customer support providers was compromised. The attackers gained access to information from users who had contacted Discord’s “Customer Support” or “Trust & Safety” teams. The company noted that the unauthorized party’s goal was to obtain data and demand a financial ransom. 

 

What data was involved?

Discord says the exposed information may include

• Name, Discord username, email and other contact details if provided to Discord customer support
• Limited billing information such as payment type, the last four digits of credit cards, and purchase history if associated with a user’s account
• IP addresses
• Messages with customer service agents 
• Limited corporate data (training materials, internal presentations)

Additionally, a small number of government ID images — such as driver’s licenses or passports — were also exposed from users who had appealed an age determination. The company clarified that full credit card numbers, CCV codes, account passwords, and Discord activity outside of support conversations were not affected. 

What is Discord doing now?

Discord is currently notifying affected users via official emails. The company also said that impacted individuals will be informed if their ID documents may have been accessed. The company has urged users to remain cautious of suspicious communication and assured that phone calls will not be used to reach out about this incident.

 

Meanwhile Discord said that it has revoked the provider’s access to its ticketing system, launched an internal investigation, and hired a computer forensics firm to assist with remediation.