Discord: Third-party support breach exposed user IDs and ID photos

Discord confirmed that an intrusion of a thirdparty customer support system on September 20 exposed the personal information and government identification photos of a subset of users, saying approximately 70,000 government ID images may have been accessed. The company said the breach did not involve its core platform and affected only people who had contacted its Customer Support or Trust and Safety teams, including users appealing age determinations.

Discord said the compromised records could include government ID images such as passports and drivers licenses, as well as names, Discord usernames, email and contact details, IP addresses, transcripts of support interactions, and limited billing information such as payment type, purchase history and the last four digits of credit cards. The company said full credit card numbers, CVV codes, account passwords, authentication data and private messages on Discord outside of support tickets were not accessed.

Company officials and multiple reports identified the incident as an attack on a Zendesk instance operated by the vendor that provided support services for age verification and appeals. Zendesk said its own platform was not...