Discord discloses third-party breach affecting customer support data

Discord disclosed a third-party breach at a customer service provider that exposed data from users who contacted its Support or Trust & Safety teams, with notifications launched about the incident. According to Security Affairs, the breach occurred on 20 September 2025, and the company noted that it did not gain access to Discord’s systems directly.

The stolen information includes names, usernames, emails, contact and billing details, IPs, and messages with agents, with government ID images also exposed for users who appealed age verification decisions. It was stated that financial data such as full credit card numbers or CCV codes, along with passwords or authentication data, were exposed, though Discord emphasised that its own systems were not breached.

Discord promptly revoked the third-party provider’s access to its support systems, launched an internal investigation with a leading computer forensics firm, notified law enforcement, and said it was informing affected users by email while advising them to be wary of suspicious communications.