Hackers are extorting Discord with 2 million photos of users

Discord confirmed an unauthorized third party gained access to one of its third-party customer service providers, exposing user data, which Discord claimed only affected a small number of users. Now, reports are surfacing that the group is claiming to have stolen 1.5 terabytes worth of age verification images of users, totaling an astounding 2,185,151 images.

The update has been provided by the X account Discord Previews, which writes that it has learned the perpetrators of the attack have secured the age verification images of Discord users, and are now using them to extort Discord.

As for the hack itself, Discord confirmed the breach took place in late September, and the unauthorized third-party managed to gain access to user information such as names, Discord usernames, emails, and other contact information, along with limited billing information, such as payment type, last four digits of credit card numbers, purchase history, IP addresses, messages with customer support agents, and limited corporate data such as training materials and internal presentations.

It should be noted that information such as full credit card details, CCV numbers, private messages, passwords, and other sensitive data wasn't involved in the hack, and that Discord itself wasn't compromised, just the third-party customer service entity.

What is raising some eyebrows is that the perpetrators are claiming to have obtained age verification images, but Discord's own policy states that it doesn't store personal identity documents, as they are deleted shortly after the age verification process has been completed.

"Discord and k-ID do not permanently store personal identity documents or your video selfies. The image of your identity document and the ID face match selfie are deleted directly after your age group is confirmed, and the video selfie used for facial age estimation never leaves your device," reads Discord's policy