Discord confirms personal data breach, including age verification data

In a blog post, video game chat platform Discord has disclosed a personal data breach after an unauthorised party compromised a third-party customer service provider, resulting in the personal information of a limited number of users being accessed. The company stated that the attacker gained access to user data on or around 20 September with the goal of financial extortion.

The compromised information may include usernames, email addresses, billing details, the last four digits of credit card numbers, IP addresses, and customer support messages. 

Critically, the attacker also accessed a "small number of government ID images", such as driving licences and passports, belonging to users who had submitted them for age verification appeals. 

Discord has since revoked the third-party provider's access, launched an internal investigation, and engaged with law enforcement and relevant authorities. Affected users were being notified individually, with the company confirming if their identity documents were among the accessed files.

In an update, BBC News reports that official ID photos of around 70,000 users were potentially leaked in the breach.

Discord has not yet confirmed whether users' data in the UK or Europe has been compromised. 

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.