Thieves steal IDs and payment info after data leaks from Discord support vendor
(2025/10/06)
- Reference: 1759753083
- News link: https://www.theregister.co.uk/2025/10/06/discord_support_data_breach/
- Source link:
Discord has confirmed customers' data was stolen – but says the culprit wasn't its own servers, just a compromised support vendor.
The chat platform [1]revealed late last week that an unnamed customer service vendor had been compromised, exposing support tickets and personal details submitted by users who had contacted Discord's help or Trust & Safety teams.
The company stressed that its own systems were not directly accessed. However, stolen data may include names, email addresses, billing information such as payment type and the last four digits of credit cards, and – in some cases – images of government IDs provided for age verification purposes.
[2]
Discord stated that attackers could access IP addresses, messages, and attachments sent to customer service agents.
[3]
[4]
"An unauthorized party targeted our third-party customer support services to access user data, with a view to extort a financial ransom from Discord," the company said.
Discord said it cut off the vendor's access as soon as the intrusion was detected, launched an internal investigation, and notified law enforcement. The company is now emailing affected users, warning them to stay alert for scams or attempts to exploit the stolen information.
[5]Red Hat fesses up to GitLab breach after attackers brag of data theft
[6]Oracle tells Clop-targeted EBS users to apply July patch, problem solved
[7]Criminals take Renault UK customer data for a joyride
[8]Clop-linked crims shake down Oracle execs with data theft claims
Some reports have named a customer support vendor, but the company has not confirmed that detail, nor has it named the contractor responsible for handling support tickets.
The number of people affected remains unanswered. Discord describes the number as "limited," but with more than 200 million active users each month, even a sliver of its support interactions could amount to a sizable haul of personal data.
[9]
Discord has yet to respond to The Register's questions about which vendor was compromised or how many users were caught in the breach. The company now faces the unenviable task of reassuring users that their personal data is secure – even when it wasn't its own systems that sprang the leak. ®
Get our [10]Tech Resources
[1] https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aOPnnF9dI9tTcaz8QVq2dQAAANU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aOPnnF9dI9tTcaz8QVq2dQAAANU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aOPnnF9dI9tTcaz8QVq2dQAAANU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2025/10/03/red_hat_gitlab_breach/
[6] https://www.theregister.com/2025/10/03/oracle_ebs_clop_extortion/
[7] https://www.theregister.com/2025/10/03/renault_uk_customer_data_breach/
[8] https://www.theregister.com/2025/10/02/clop_oracle_extortion/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aOPnnF9dI9tTcaz8QVq2dQAAANU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
The chat platform [1]revealed late last week that an unnamed customer service vendor had been compromised, exposing support tickets and personal details submitted by users who had contacted Discord's help or Trust & Safety teams.
The company stressed that its own systems were not directly accessed. However, stolen data may include names, email addresses, billing information such as payment type and the last four digits of credit cards, and – in some cases – images of government IDs provided for age verification purposes.
[2]
Discord stated that attackers could access IP addresses, messages, and attachments sent to customer service agents.
[3]
[4]
"An unauthorized party targeted our third-party customer support services to access user data, with a view to extort a financial ransom from Discord," the company said.
Discord said it cut off the vendor's access as soon as the intrusion was detected, launched an internal investigation, and notified law enforcement. The company is now emailing affected users, warning them to stay alert for scams or attempts to exploit the stolen information.
[5]Red Hat fesses up to GitLab breach after attackers brag of data theft
[6]Oracle tells Clop-targeted EBS users to apply July patch, problem solved
[7]Criminals take Renault UK customer data for a joyride
[8]Clop-linked crims shake down Oracle execs with data theft claims
Some reports have named a customer support vendor, but the company has not confirmed that detail, nor has it named the contractor responsible for handling support tickets.
The number of people affected remains unanswered. Discord describes the number as "limited," but with more than 200 million active users each month, even a sliver of its support interactions could amount to a sizable haul of personal data.
[9]
Discord has yet to respond to The Register's questions about which vendor was compromised or how many users were caught in the breach. The company now faces the unenviable task of reassuring users that their personal data is secure – even when it wasn't its own systems that sprang the leak. ®
Get our [10]Tech Resources
[1] https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aOPnnF9dI9tTcaz8QVq2dQAAANU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aOPnnF9dI9tTcaz8QVq2dQAAANU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aOPnnF9dI9tTcaz8QVq2dQAAANU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2025/10/03/red_hat_gitlab_breach/
[6] https://www.theregister.com/2025/10/03/oracle_ebs_clop_extortion/
[7] https://www.theregister.com/2025/10/03/renault_uk_customer_data_breach/
[8] https://www.theregister.com/2025/10/02/clop_oracle_extortion/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aOPnnF9dI9tTcaz8QVq2dQAAANU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
Re: So . . .
tiggity
Indeed - beat me to it
"and – in some cases – images of government IDs provided for age verification purposes."
The sort of thing many websites / apps are now doing in the UK after recent stupid (but loved by the surveillance state) age ID laws.
Re: So . . .
Anonymous Coward
What I don't understand is, once a person is "age verified" then why do these people need to keep a copy of the ID. Especially as this is just forum software.
Re: So . . .
Chloe Cresswell
Because if you have issues doing age verification, or it thinks you are younger then you are, you have to open a support ticket and interact with the support staff.
That's where the copy of the ID came in, not at the age verification step, but because the age verification had issues and they needed to submit more evidence to the support system.
So . . .
Are we _still_ in favour of using the internet to store personal data? If so, how bad does it need to get until people realise it is simply not fit for purpose. It is toxic with criminals and state actors and we the public are simply no match for them.