Discord confirms user personal data was stolen by hackers

Discord has confirmed that user information was used as leverage by an unauthorized party in an attempt to extort a financial ransom from Discord.

Discord confirms user personal data was stolen by hackers
Comment IconFacebook IconX IconReddit Icon
Tech and Science Editor
Published
1 minute & 45 seconds read time
TL;DR: Discord confirmed a breach of a third-party customer service provider, exposing limited user data such as contact details, partial billing info, support messages, and some government ID images. Discord revoked access, is investigating with forensics experts, notifying affected users, and cooperating with law enforcement to address the incident.

Discord has confirmed in a recent press release that one of the company's third-party customer service providers was breached by an unauthorized party, which gained access to information about users.

Discord confirms user personal data was stolen by hackers 651156
2

The press release states that one of Discord's third-party customer service providers was breached by an "unauthorized party," and that this party accessed information on users, such as conversations they have had with Customer Support or Trust & Safety agents. Discord writes that it immediately revoked the customer support provider's access to its ticketing system as the company continues its investigation into the situation.

Discord states this unauthorized party only gained access to the third-party customer service provider, and not Discord itself. Furthermore, Discord states the impact of the breach is only a "limited number of users," and once the breach was detected, it severed the third-party's connection to its ticketing system, began working with a leading computer forensics firm to support its investigation, and engaged with law enforcement.

As for the users, Discord states it's currently in the process of contacting all users who the breach has impacted. Notably, Discord writes that a third party attempted to use its access to the customer support service as leverage to extort a financial ransom from Discord.

What data was involved?

The data that may have been impacted was related to our customer service system. This may include:

  • Name, Discord username, email and other contact details if provided to Discord customer support
  • Limited billing information such as payment type, the last four digits of your credit card, and purchase history if associated with your account
  • IP addresses
  • Messages with our customer service agents
  • Limited corporate data (training materials, internal presentations)

The unauthorized party also gained access to a small number of government‑ID images (e.g., driver's license, passport) from users who had appealed an age determination. If your ID may have been accessed, that will be specified in the email you receive.

  • What data was not involved?
  • Full credit card numbers or CCV codes
  • Messages or activity on Discord beyond what users may have discussed with customer support
  • Passwords or authentication data