Discord Confirms Possible Leak of 70,000 Users’ ID Photos After Cyber-Attack
Discord has revealed that personal identification photos belonging to roughly 70,000 users may have been compromised following a cyber-attack on one of its third-party service providers.
The company, which hosts more than 200 million users globally, said the incident did not involve a direct breach of its own systems. Instead, hackers reportedly targeted an external firm responsible for verifying users’ ages on the platform – a process that requires individuals to upload government-issued identification.
In a statement, the San Francisco–based company said the potentially exposed data may include personal information, partial credit card details, and messages exchanged with Discord’s customer support team. However, it emphasised that passwords, full credit card numbers, and private user messages were not affected.
Discord confirmed that all affected users have been notified and that it is cooperating with law enforcement to investigate the breach. Access for the compromised third-party support vendor has also been revoked. The company did not disclose the name of the vendor involved.
A spokesperson for Zendesk – a major customer service software provider used by Discord – told the BBC that its systems were not compromised, clarifying that the breach did not stem from a flaw within its platform.
In the wake of the attack, some online users have claimed that the scale of the breach is larger than Discord has reported. The company has dismissed those claims, calling them false and part of an extortion attempt.
Cybersecurity experts note that ID documents and personal data are highly sought after by hackers, often fetching significant sums on the dark web for use in scams and identity theft. Unlike credit card details, personal identifiers such as names and national ID numbers are far harder to replace.
Discord has faced mounting scrutiny in recent years over how it moderates user activity. The company previously tightened its age-verification process after reports that some servers were being used to share adult or extremist content.
While the full extent of the latest breach remains under investigation, Discord says it is taking additional steps to bolster its data protection systems and prevent similar incidents in the future.
