Discord warns users after data stolen in third-party breach

Discord warns users after data stolen in third-party breach. The breach occurred on 20 September and involved a third-party customer support provider rather than a direct attack on Discord’s servers. According to Rescana, attackers identified themselves as Scattered Lapsu$ Hunters (SLH); BleepingComputer also reported this, though SLH later shifted its story.

The compromised data included real names, Discord usernames, email addresses, and other contact details, with some cases exposing limited billing information such as payment type, the last four digits of credit card numbers, and purchase histories, alongside client IP addresses and messages with support agents.

Some users had particularly sensitive information stolen, with government‑ID images from those who had appealed an age determination, and Discord said recipients would be notified by email if their ID had been accessed. Discord disclosed the incident on 3 October and has revoked the influence of the affected partner, begun an internal investigation, and advised that communication will come from noreply@discord[.]com.