Discord’s recent support data breach exposes user info, ID photos, and credit card details

Discord has recently confirmed a big data breach involving one of its third-party customer service providers. While the company’s own systems were not directly compromised, attackers gained access to the external support partner, exposing data from users who had contacted Discord’s Customer Support or Trust & Safety teams. The leaked information includes names, usernames, email addresses, and the last four digits of credit cards.

Notably, a small number of government-issued identification images such as passports and driver’s licenses were accessed. These ID photos were submitted by users appealing Discord’s age verification process, which was recently introduced to comply with regulations in Britain and select U.S. states. Attackers reportedly tried to extort Discord with a ransom demand using data taken in the breach.

Discord says no passwords, authentication data, or full credit card details were affected. The company is emailing impacted users, specifying if ID images were involved, and has revoked the vendor’s access, notified data protection authorities, and engaged law enforcement. It has also strengthened threat detection and third-party security measures. Users who have not recently engaged with customer support are probably not impacted.