Discord Alerts 70,000 Users About Potential Access to Profile Images in Data Breach

Discord has officially acknowledged that approximately 70, 000 users may have had images of their government-issued identification compromised due to a recent data breach linked to one of its third-party customer service providers.

In early October, the platform disclosed in a security update that a data breach had occurred, affecting an undetermined volume of user information. This revelation spurred speculation across social media, with claims suggesting that over two million age verification images were at risk in the breach, leading to potential extortion attempts against the company.

On October 8, Nu Wexler, a spokesperson for Discord, clarified to The Verge that the figures circulating online were inflated, yet confirmed an extortion attempt aimed at the company. Wexler emphasized the following key points:

“First, as stated in our blog post, this was not a breach of Discord, but rather a third-party service we use to support our customer service efforts.

Second, the numbers being shared are incorrect and are part of an attempt to extort a payment from Discord. Of the accounts impacted globally, we have identified approximately 70, 000 users who may have had government-ID photos exposed, which our vendor used to review age-related appeals.

Third, we will not reward those responsible for their illegal actions.”

Discord promotional splash art — Discord

Details of the Breach Involving Customer Service

According to Discord’s findings, the breach may have exposed a variety of user data, including names, usernames, email addresses, IP addresses, and messages sent to customer support. Additionally, some limited billing details, such as payment types, the last four digits of credit cards, and purchase history, might have been accessed.

Notably, Discord confirmed that sensitive information such as passwords, authentication credentials, and complete payment details were not part of the exposed data.

In response to the incident, Discord promptly terminated the affected vendor’s access to its internal systems, initiated an internal inquiry with the assistance of a computer forensics firm, and alerted law enforcement agencies to the situation.

Source&Images