Discord Data Breach Exposes 1.5 TB of Data and 2 Million Government ID Photos

The popular messaging platform Discord is facing a major extortion attempt after criminals breached a third‑party customer service provider, compromising data including government ID photos used for age verification. Threat actors claim to have exfiltrated 1.5 terabytes of sensitive information, including over 2.1 million government-issued identification photos, though Discord disputes these figures and says about 70,000 ID photos were exposed in the September 20, 2025 incident.

The breach targeted Zendesk, a vendor handling Discord’s support operations, rather than Discord’s infrastructure, with attackers gaining access for 58 hours through a compromised support agent account. The group behind the attack, Scattered Lapsus$ Hunters (SLH), has claimed responsibility and is seeking a ransom. Compromised data also includes user names, emails, login details, limited billing information such as the last four digits of cards, and customer service message exchanges, along with user IP addresses.

The incident underscores the risk of supply‑chain style breaches in outsourced support environments, with Discord having revoked vendor access and launched an internal investigation in collaboration with law enforcement and data protection authorities, according to Discord.