Discord reports data breach exposing user IDs and passports

Discord has disclosed a data breach affecting documents submitted by some users for age verification, following a cyberattack on one of its third-party contractors handling content moderation and customer support.

According to the company, the incident impacted a subset of users who had interacted with Discord’s support team or its Trust & Safety division. Hackers gained access to limited personal details, including names, email addresses, and the last four digits of payment cards.

Discord stressed that its own internal systems were not compromised: attackers did not access its core database, user passwords, or full payment information. However, the company confirmed that the hackers attempted to extort money in exchange for not releasing the stolen data.

The breach also involved “a small number” of government-issued IDs, such as scanned passports and driver’s licenses, submitted by users for age verification.

Discord says it has revoked the compromised contractor’s access, strengthened oversight of external partners, and notified regulators. Impacted users are being contacted by email, with additional notices for those whose identity documents may have been exposed.