Discord, a popular voice chat and messaging platform, has revealed that a security breach exposed the personal information of approximately 70,000 users, including government IDs collected for age verification. The company initially stated that only a “small number” of IDs were accessed, and those impacted would be notified by email.
The breach occurred when a malicious actor gained access to a third-party service employed by Discord to manage its customer service, allowing them to view information concerning users who had reached out to customer support. This included users’ names, contact details, IP addresses, purchase histories, and the last four digits of their credit cards. However, Discord stresses that no full credit card numbers or passwords were accessed.
The company has contacted all affected users globally and is working closely with law enforcement, data protection authorities, and external security experts. Discord introduced age verification in some regions earlier this year, requiring users to provide a photo of themselves with their ID. The company partners with a third-party service provider to verify users’ ages, and both Discord and the provider delete images of users’ IDs immediately after their age is confirmed.
The breach highlights concerns surrounding age verification laws, which several governments are implementing to prevent children from accessing inappropriate content. Research suggests that these laws can compromise user privacy and safety, and many advocates recommend on-device age verification as a safer and more effective alternative.
Discord’s situation is a significant example of the potential risks associated with collecting and storing sensitive user information. The company’s decision not to pay a ransom to the malicious actor is a notable step in addressing the breach. As the situation continues to unfold, it remains to be seen how Discord and other companies will adapt to the challenges of protecting user data in the face of increasingly sophisticated cyber threats.
