Discord Says User Information Stolen in Third-Party Data Breach

Discord says hackers accessed personal data held by a third‑party customer service provider, not its own systems, and the incident affected only users who contacted Discord’s Customer Support and/or Trust & Safety teams. The compromised information includes names, usernames, email addresses, contact details, IP addresses, billing information, messages exchanged with customer service agents, and limited corporate data, with government ID images also exposed for users who had appealed age determinations.

The company states that no financial information, Discord activity or messages, or passwords and other authentication data were affected, and it has begun notifying affected users by email while engaging authorities, initiating an internal investigation, and revoking the third‑party provider’s access to its ticketing system.

According to SecurityWeek, threat intelligence project Vx-Underground says the data breach occurred on 20 September, though SecurityWeek notes it has not disclosed how many users were impacted or which third‑party service was involved. Some reports connected the incident to a Salesforce extortion campaign linked to the Scattered LAPSUS$ Hunters group, but Vx‑Underground described it as a Discord Zendesk compromise and said the attackers do not have an attributed threat group name. SecurityWeek adds that Discord has not provided further details and will update the article if the company responds.