Discord has reported a security breach involving one of its third-party customer service vendors, which was accessed by an “unauthorized party.” According to the company, this breach allowed the intruder to obtain information from a select group of users who had interacted with Discord’s Customer Support and Trust & Safety teams. The intent of this intrusion appears to be an attempt to extort a financial ransom from Discord. Importantly, the intruder did not gain direct access to Discord’s systems.
The compromised data may include users’ names, usernames, email addresses, and the last four digits of their credit card numbers. Additionally, a small number of images of government identification documents were accessed from users who had previously requested appeals regarding age verifications. Thankfully, full credit card numbers and user passwords were not affected by this incident, according to Discord.
Discord is currently reaching out to affected users via email to inform them of the situation, specifying if their personal information may have been accessed. In response to the breach, Discord has terminated the customer support provider’s access to its ticketing system, alerted data protection authorities, and is collaborating with law enforcement. Additionally, the company is conducting a review of its threat detection systems and security measures pertaining to third-party support services.
