Government ID photos of about 70,000 Discord users worldwide may have been exposed after hackers compromised a third-party company contracted to carry out age verification checks, the messaging platform has confirmed.
The breach, which was made public last week, also risks exposing some users’ names, email addresses, other contact details, IP addresses and messages with Discord’s customer service agents. Discord said the attacker had attempted to extort a ransom from the company, but that no full credit card details or passwords were seized.
The potentially affected photos were provided by users making age-related appeals to Discord’s customer services contractor, often after being locked out of the platform. Under the UK’s Online Safety Act, social media and messaging providers have been required to carry out age checks since July to ensure child safety. Cybersecurity experts have warned that firms offering such checks, which can require government IDs, are becoming attractive targets for hackers due to the high volume of sensitive data held.
In a statement, Discord said: “Recently, we discovered an incident where an unauthorised party compromised one of Discord’s third-party customer service providers. The unauthorised party then gained access to information from a limited number of users who had contacted Discord through our customer support and/or trust and safety teams… Of the accounts impacted globally, we have identified approximately 70,000 users that may have had government ID photos exposed, which our vendor used to review age-related appeals.”
Nathan Webb, a principal consultant at UK digital security company Acumen Cyber, called the breach “very concerning”. He said: “Despite age verification being outsourced, businesses still have an accountability to ensure that data is stored appropriately. It’s important for organisations to recognise that delegating certain processes does not absolve their responsibility to uphold data protection and security standards.” The UK’s Information Commissioner’s Office said it had received a report from Discord and was assessing the information provided.
