User Identity Theft on Discord

In October 2025, Discord, the popular communication platform for millions of users, suffered a serious personal data theft that ignited a deep debate on online user security and privacy.

The alarm came directly from the company, which confirmed that the cyber attack did not hit Discord’s main servers but occurred through an external vendor tasked with managing customer service and Trust & Safety support.

The attack was identified and made public in the first days of October 2025, specifically on October 5, when Discord began notifying users potentially involved in the breach. The hackers managed to obtain an impressive amount of data—about 1.5 terabytes—including approximately 70,000 images belonging to users who had contacted customer support.

Among the stolen data were sensitive personal details such as names, usernames, email addresses, and contact information like mobile phone numbers. Particularly concerning was the compromise of the last four digits of credit cards and, most importantly, photographs and scans of identity documents used by users for age verification, as required by regulations in some countries like the UK under the Online Safety Act. These documents are essential for proving users are of legal age, and their exposure represents a significant risk of identity theft and fraud.

According to Discord, the attack was primarily for extortion, with the cyber criminals attempting to blackmail the company by threatening to disclose the stolen data. Fortunately, the company managed to block the compromised vendor’s access to its ticketing systems and promptly initiated collaboration with the competent authorities to identify those responsible for the attack.

Discord also reassured users that no data related to personal messages, private chats, or servers was touched, as these are stored on separate, more protected infrastructures. Discord itself raised the alarm about the data theft through official communications, including detailed emails to affected users, explaining precisely what information had been exposed and suggesting actions to take to protect against possible scams or abuse.

The platform emphasized the importance of maintaining high vigilance regarding digital security, even in relationships with external vendors, as critical flaws can open up precisely through these indirect channels. This event has reignited the debate on the complexity of security in large technological platforms which, while investing significant resources to protect their main systems, must deploy equal attention in managing partnerships and accessory services. The management of age and digital identity verification is particularly sensitive and requires rigorous security protocols precisely because it involves highly confidential data.

In conclusion, the Discord data theft highlighted how cybersecurity is a continuous and complex process that must consider all links in the service chain. For users, it is crucial to adopt personal security measures like enabling two-factor authentication and avoiding sharing sensitive documents outside of official channels, while for companies, the challenge is to ensure robust protections even in dealings with external partners and vendors. Discord has already begun to act in this direction by collaborating with authorities and strengthening its internal controls to prevent future incidents of this kind.