Discord hack reaches new heights as customer service party denies data breach

Discord recently confirmed that approximately 70,000 users had sensitive information compromised from an unauthorized third party, with the voice communication platform saying it wasn't Discord itself that got hacked, but one of its third-party customer service companies.

2

However, Discord's story has now had a wrench thrown into it as that third-party customer service company has now denied it was "hacked". Here's what happened. Discord confirmed that it was hacked, with reports stating the unauthorized party stole 1.5 terabytes worth of age verification images from the customer service company. Discord refuted these claims, saying the purported 2 million images that were stolen weren't an accurate figure, and that the hackers made off with "limited" personal information.

Discord outlined the personal information that was stolen, including names, Discord usernames, emails, and other contact information, along with limited billing information, such as payment type, last four digits of credit card numbers, purchase history, IP addresses, messages with customer support agents, and limited corporate data, such as training materials and internal presentations. Furthermore, the platform said it had immediately severed its connection with the third-party customer service company once it was made aware of the hack.

• Read more: Discord confirms government ID photos of users were stolen by hackers
• Read more: Discord confirms user personal data was stolen by hackers

Discord stated that it had identified "70,000 users that may have had government-ID photos exposed, which our vendor used to review age-related appeals," and went on to say that Discord itself wasn't breached, "this was not a breach of Discord, but rather a breach of a third party service provider, 5CA, that we used to support our customer service efforts."

However, 5CA has now responded to this accusation by stating its systems remain secure and no such hack ever took place. Moreover, 5CA states it hasn't handled any government-issued IDs for Discord. 5CA's statement is provided in full below.

We are aware of media reports naming 5CA as the cause of a data breach involving one of our clients. Contrary to these reports, we can confirm that none of 5CA's systems were involved, and 5CA has not handled any government-issued IDs for this client. All our platforms and systems remain secure, and client data continues to be protected under strict data protection and security controls.

We are conducting an ongoing forensic investigation into the matter and collaborating closely with our client, as well as external advisors, including cybersecurity experts and ethical hackers. Based on interim findings, we can confirm that the incident occurred outside of our systems and that 5CA was not hacked. There is no evidence of any impact on other 5CA clients, systems, or data. Access controls, encryption, and monitoring systems are fully operational and, as a precautionary measure, are under heightened review.

Our preliminary information suggests the incident may have resulted from human error, the extent of which is still under investigation. We remain in close contact with all relevant parties and will share verified findings once confirmed.