As someone who has worked in cybersecurity, there’s a saying in the industry: “You can never be too secure.” But companies are facing increasingly dangerous risks from zero-day attacks, as well as some laws that require users to share even more sensitive data. That all came to a head with a recent Discord security breach.
As confirmed by The Verge, Discord spokesperson Nu Wexler has shared that roughly 70,000 users have been impacted by a data breach. This breach includes government IDs, which Discord claims were accessed via a “third-party customer service provider.” For reference, Discord has grown to roughly 200 million active monthly users this year.
Discord Confirms Security Breach Affecting Up To 70,000 Users
Not Every User Was Impacted
After Discord noted the breach in a more general sense last week, more details are starting to form as to what actually happened. According to Wexler, this is an attempt to “extort a payment from Discord,” and the number of impacted users is roughly 70,000.
As a result, Discord has provided the following statement to impacted users:
All affected users globally have been contacted, and we continue to work closely with law enforcement, data protection authorities, and external security experts. We’ve secured the affected systems and ended work with the compromised vendor. We take our responsibility to protect your personal data seriously and understand the concern this may cause.
The issue arises from a third-party vendor that verifies government IDs, which some users need to upload to prove their age and identity. These laws are currently implemented (or are in the process of rolling out) in Australia and the United Kingdom, and specific US states are toying with similar legislation.
It’s part of a growing concern about recent legislation, which requires users in specific regions to upload government IDs to utilize services. Many opponents to said legislation note that you’re opening yourself up to further data breaches, which happened directly here with Discord, one of the world’s most popular communication apps.
Everything That Was Leaked From Discord’s Security Breach
Government IDs Are The Main Leak
Discord has shared that the following information was part of the recent security breach, as detailed on their official blog:
- Emails
- Credit card info (last four digits)
- Usernames
- IP addresses
- Government IDs
According to Discord, full credit card numbers, CCV codes, messages or activity, or passwords/authentication data were not impacted as a result of the breach. While it could have been worse, leaked government IDs are never a good look. These new legislative rollouts will continue to cause more headaches, especially for companies not adequately equipped for security concerns.
Discord stresses that this was not a breach of Discord’s data itself, but a third-party vendor. They’ve taken swift action, including revoking the vendor’s access while they continue to investigate the issue with law enforcement, and notify impacted users.