A security incident at a third-party service provider has exposed Discord user data, with the company now confirming that a significant number of government identification photos were compromised. The breach, which occurred through a vendor used for customer support, initially led Discord to state that only a small number of government IDs were accessed. However, new information reveals the scope is much larger. Following claims circulating online that attackers had obtained a trove of over 2 million photos used for age verification, Discord has provided an updated figure. The company now states that approximately 70,000 users may have had their government ID photos exposed in the hack. This type of data is among the most sensitive, as it can include images of drivers licenses, passports, and other official documents that users submitted for verification purposes. Beyond the ID photos, the compromised information includes a range of personal data. Discord has indicated that for affected users, the breach also encompassed their name, Discord username, email address, and any other contact details they had provided to customer support. A limited amount of billing information was also potentially accessed. In response to the alarming claims of a multi-million photo leak, a Discord spokesperson addressed the situation. They stated that the figures being shared publicly are inaccurate and are part of an extortion attempt by the attackers. The company has firmly stated it will not pay any ransom, emphasizing that it does not reward illegal actions. Discord has confirmed that all users globally who were impacted by this breach have been directly contacted. The company is working with law enforcement agencies, data protection authorities, and external security experts as part of its response. To prevent future incidents, Discord has secured the affected systems and has terminated its relationship with the compromised vendor. This incident serves as a critical reminder of the risks associated with submitting sensitive personal documents to online platforms, even for legitimate purposes like age verification. Users who have engaged with Discord customer support, particularly those who submitted identification, should be vigilant for any official communication from Discord and monitor their accounts for suspicious activity.
