A third-party customer service provider for Discord experienced a security breach by an “unauthorized party,” the company reports. This unauthorized entity accessed “information from a limited number of users who had contacted Discord via our Customer Support and/or Trust & Safety teams” with the intention to “extort a financial ransom from Discord.” However, the unauthorized party did “not gain access to Discord directly.”
The compromised data may include names, usernames, email addresses, and the last four digits of credit card numbers. The unauthorized party also obtained a “small number” of government ID images from “users who had appealed an age determination.” Discord assures that full credit card numbers and passwords were not affected by the breach.
Affected users are being notified via email. If there’s a chance your ID was accessed, Discord will inform you accordingly. Additionally, Discord has revoked the support provider’s access to its ticketing system, contacted data protection authorities, is collaborating with law enforcement, and has reassessed “our threat detection systems and security controls for third-party support providers.”
