Discord Customer Service Breach Exposes User Data

Discord announced that its third-party customer service provider experienced a data breach, which exposed information from a limited number of users.

The company says an “unauthorized party” accessed information from users who contacted Discord’s Customer Support or Trust & Safety teams, apparently aiming to “extort a financial ransom from Discord.”

Discord emphasized that the attackers “did not gain access to Discord directly” and no messages or activity outside of customer support communications were exposed. The potentially accessed data includes names, usernames, emails, IP addresses, the last four digits of credit card numbers, and purchase history if provided to support.

A “small number” of government ID images from users who appealed age determinations, such as driver’s licenses or passports, were also accessed. Full credit card numbers, passwords, and other authentication data were not affected.

The company sends email notifications to affected users who can check if their account ID was compromised. Discord warns that communications about the incident will only come from ‘[email protected],’ and not by phone.

The company took immediate action by cutting off all access to its ticketing system from the third-party provider while starting an internal investigation with the help of law enforcement and a leading computer forensics firm.

The company examined its security systems that detect threats and its third-party support provider’s security controls, and informed all necessary data protection organizations.

Discord protects user information while sending alerts about possible suspicious messages to users. “At Discord, protecting the privacy and security of our users is a top priority. That’s why it’s important to us that we’re transparent with them about events that impact their personal information,” the company said.

Third-party service vulnerabilities lead to security breaches that affect users through their data management operations, even though the primary platform remains secure.