Discord, a popular voice‑chat and messaging platform, disclosed a security breach that exposed the personal information of roughly 70,000 users, including government IDs collected for age verification. Initially, the company said only a “small number” of IDs had been accessed and that affected users would be notified by email.
The breach occurred when a malicious actor gained access to a third‑party service Discord uses to manage its customer‑service operations. Through this access, the attacker could view data for users who had contacted support, including names, contact details, IP addresses, purchase histories, and the last four digits of credit cards. Discord emphasized that full credit‑card numbers and passwords were not compromised.
Discord has contacted all affected users worldwide and is cooperating with law enforcement, data‑protection authorities, and external security experts. Earlier this year, the platform introduced age verification in certain regions, requiring users to submit a photo of themselves with an ID. A third‑party provider assists with verification, and both Discord and the provider delete the ID images immediately after confirming age.
The incident underscores concerns about age‑verification laws that many governments are adopting to keep children from accessing inappropriate content. Research indicates such laws can jeopardize user privacy and safety, with advocates recommending on‑device age verification as a safer, more effective alternative. Discord’s breach serves as a stark example of the risks associated with collecting and storing sensitive user information. Notably, the company chose not to pay a ransom to the attacker. As the situation unfolds, it remains to be seen how Discord and other companies will adapt to the challenges of safeguarding user data against increasingly sophisticated cyber threats.
Comments are closed for this story.