Discord customer service system breached by “unauthorised party”, gaining access to “a small number of government-ID images”

A third-party customer service system used by Discord’s support teams has been hacked, compromising some user personal data, including government IDs.

Discord has written to some users confirming that on 20th September, personal data was obtained by “an unauthorised party” which gained limited access, including “a small number of government‑ID images such as driver’s license and passports from users who had appealed an age determination”.

Discord – which is used by millions of gamers across the world – says information shared by users with its Customer Support or Trust and Safety teams was “exposed”, including real names, Discord name, email, contact address, limited payment information – including payment type, last four digits of credit cards, and purchase history – IP addresses, and messages and attachments sent to customer support. Limited corporate data, including training materials and internal presentations, was also exposed.

Full credit card numbers or CCV codes, Discord activity or messages, and passwords or authentication data were reportedly not compromised, but Discord has not revealed how many of its millions of users may have been impacted.

In a blog post, Discord insisted that just “a limited number of users who had communicated with customer support” were impacted, and the authorised party did not gain access to Discord directly. It also claimed to have taken “all appropriate steps” by notifying data protection authorities, law enforcement, and “reviewed our threat detection systems and security controls for third-party support providers”.

“Looking ahead, we recommend impacted users stay alert when receiving messages or other communication that may seem suspicious. We have service agents on hand to answer questions and provide additional support,” Discord said. “We take our responsibility to protect your personal data seriously and understand the inconvenience and concern this may cause.”

An earlier edition of this story referred to the breach as “authorised”, not “unauthorised”. This has been amended. Apologies for any confusion.