Overview

• A company update says roughly 70,000 people who submitted IDs for age-related appeals may have had images accessed, with notifications sent from [email protected].
• Exposed fields could include names, Discord usernames, emails, IP addresses, support messages and limited billing data such as purchase history and the last four digits of cards; full card numbers, passwords and regular chats were not taken.
• Attackers and some researchers assert a haul of about 1.5 TB covering roughly 2.1 million ID photos and are attempting to extort Discord, a claim the company rejects as inaccurate.
• Reports trace the intrusion to around September 20 and to a third-party customer support system linked by outlets to Zendesk, which says its platform was not compromised by a vulnerability.
• Discord says it revoked the vendor’s access, engaged external forensics, notified regulators and law enforcement, and warns users to watch for targeted phishing as debate grows over ID-based age verification risks.