Discord says data exposed via third-party vendor breach

Discord disclosed on October 3 that attackers accessed user data on September 20 by compromising a third party customer service provider, exposing information from a limited number of users who recently contacted the platform's Customer Support or Trust and Safety teams. The company said its own systems were not directly breached and that it has revoked the vendor's access, engaged forensic investigators and law enforcement, and begun notifying impacted users by email.

According to Discord, the data taken included real names, Discord usernames, email addresses and other contact information, the contents of support tickets, IP addresses, limited billing details such as payment type and the last four digits of card numbers, and some internal training materials. A small number of government issued ID images submitted for age-verification appeals also may have been accessed. Discord said full credit card numbers, CVV codes, account passwords, authentication data and private messages or server chats outside of customer support interactions were not accessed.

Company officials described the intrusion as an attempt to extort Discord for money. Discord said in a statement that...