Video game chat platform Discord has suffered a data breach, informing users that their personal information – including identity documents of those required to prove their age – were compromised.
The company stated last week that an unauthorised party had compromised one of Discord’s third-party customer service providers, leading to the access of “a limited number of users” who had been in contact with the customer service or trust and safety teams.
The data compromised may have included usernames, email, billing information, the last four digits of credit card numbers, IP addresses and messages with customer support. Discord said the alleged attacker “also gained access to a small number of government ID images (eg driving licence, passport) from users who had appealed an age determination.”
Affected users were in the process of being notified as of last week. “If your ID may have been accessed, that will be specified in the email you receive,” Discord said. The support system was targeted to access user data with a view to extort a financial ransom from Discord, the company stated.
Discord said it revoked the third-party provider’s access to its ticketing system and launched an internal investigation, including engaging with law enforcement. The attack appears to have occurred on 20 September, according to a user who received a notification.
