The Discord data breach exposed government ID photos of about 70,000 users after attackers got into a third party customer support system on September 20, 2025. The IDs had been submitted for age verification appeals, and the stolen data also included names, email addresses, IP addresses, support messages and partial billing details. Discord refused a ransom demand, cut ties with the vendor, and a year later is rolling out a new age verification system that it says no longer runs through that support channel.
Key takeaways
- What leaked: about 70,000 government ID photos, plus contact details, IP addresses, support chats and the last four digits of some cards
- Who was affected: only people who had contacted Discord Customer Support or Trust and Safety
- How: attackers accessed a support system run by an outside vendor; Discord’s own servers were not breached
- Hacker claims: 1.5 TB of data and about 2.1 million ID images, which Discord called inaccurate and part of an extortion attempt
- Since then: Discord delayed, reworked and in September 2026 began rolling out global age checks with new methods
What happened
On September 20, 2025, attackers gained access to a customer service platform Discord used for support tickets and age related appeals. Discord disclosed the incident on October 3, 2025 and updated it on October 8, saying it had identified about 70,000 users whose government ID photos may have been exposed. Those images came from people who had appealed an age related decision and had sent a photo of an ID to prove their age.
Discord stressed that its own systems were not compromised. The intrusion hit a third party support environment, and the attackers reportedly had about 58 hours of access through a support agent’s account. Discord revoked the vendor’s access, ended the relationship, brought in a forensics firm and said it was working with law enforcement and data protection authorities.
| Data type | Exposed? |
|---|---|
| Government ID photos (age appeals) | Yes, about 70,000 users |
| Names, Discord usernames, email and contact details | Yes, for users who contacted support |
| IP addresses | Yes |
| Messages with support agents | Yes |
| Billing details | Limited: payment type and last four card digits |
| Full card numbers or CVV codes | No, according to Discord |
| Passwords | No, according to Discord |
| Private messages and activity outside support chats | No, according to Discord |
The hackers’ claims versus Discord’s numbers
The attackers, who were linked in reports to the group calling itself Scattered Lapsus$ Hunters, claimed far more. They said they took 1.5 terabytes of data, which the research collective vx-underground counted as 2,185,151 photos, and that they had access to Discord’s Zendesk support instance. They demanded a payment, reported at $3.5 million, and threatened to publish the data.
Discord rejected both the figures and the demand. A spokesperson told The Verge the numbers being shared were inaccurate and part of an effort to extort the company, and that Discord would not reward those responsible for illegal actions. The gap between 70,000 and 2.1 million has never been independently resolved, and outside researchers have only seen samples the attackers chose to share.
Which vendor was it?
Discord first described the vendor only as a third party customer service provider, then named 5CA, a Netherlands based customer experience company. 5CA denied that its own systems were breached, said the incident happened outside its platforms and that preliminary findings suggested “human error,” and said it had found no evidence that other clients were affected. Zendesk, whose software hosted the support tickets, said the incident was not caused by a vulnerability in its platform. The result is that three companies each say the failure was not in their systems, and no final forensic report has been published.
Why ID based age checks are the real story
Discord’s appeal process asked flagged users to submit a photo of their ID, and those images were supposed to be used for review and then deleted. The breach showed how risky that model is: once ID images sit in a ticketing system run by an outside contractor, a single compromised account can expose them. A stolen ID photo cannot be changed like a password, and it can be reused for fraud for years.
Privacy groups seized on the incident. The Electronic Frontier Foundation gave Discord its 2025 “We Still Told You So” Breachies award, arguing that mandatory age verification creates exactly this kind of honeypot. Large leaks of personal records, like the streaming service leak of 324 million records, are common, but ID images are a more dangerous category than email addresses.
What remains unknown
- No public, independent count of how many ID images were taken
- No final forensic report from Discord, 5CA or Zendesk
- Whether the full data set was ever sold or published; we found no confirmed public release as of November 2026
- The outcome of any regulatory inquiries in Europe or the US
What changed since: Discord’s age verification in 2026
The breach did not stop Discord’s push toward age checks. It reshaped it. Here is how the policy moved over the following year.
| Date | Development |
|---|---|
| October 2025 | Discord confirms the breach and says it no longer uses the compromised system for age verification |
| February 2026 | Discord announces global “teen by default” settings: users not confirmed as adults get teen restrictions unless they verify with a face scan or ID through vendors such as k-ID |
| February 24, 2026 | After heavy backlash, Discord delays the global rollout to the second half of 2026, requires on device processing for face age estimation and drops Persona, which did not meet that bar |
| September 2026 | Global rollout begins. Most users are sorted automatically from account signals such as account age and server activity, without reading message content |
The September version gives people who need to verify more options than an ID photo: a card check through Stripe (Discord says it never sees the card number), sharing an age range already held by the Apple App Store or Google Play, a Google Wallet ID, Discord’s AgeKey credential, an on device video selfie, or an ID scan paired with a selfie. Teens aged 13 to 17 can still message friends and join servers that are not age restricted, with extra protections. We cover the steps in detail in our guide to Discord age verification and how to verify in 2026.
If you have a choice, the lowest risk methods are the ones that never send an image of your ID anywhere: automatic classification, an app store age signal or an on device selfie.
What to do if you were affected
Discord said it notified affected users by email from noreply@discord.com. If you got that email, or you sent Discord an ID photo for an appeal before October 2025, take these steps:
- Freeze your credit. A freeze at Equifax, Experian and TransUnion is free in the US and blocks most new account fraud using your identity.
- Get an IRS Identity Protection PIN. It stops someone from filing a tax return in your name.
- Watch for targeted phishing. Attackers know your name, email and that you contacted Discord support. Be suspicious of any message that references a support ticket or asks you to “verify” your account.
- Secure your Discord account. Passwords were not exposed, but turn on two factor authentication and use a unique password stored in a password manager. Our guide to creating strong passwords covers the basics.
- Harden your phone. If you use Android, consider Android Advanced Protection, which adds stronger defenses against scams and malicious apps.
- Report misuse. If you spot fraud using your identity, report it at IdentityTheft.gov to get a recovery plan.
Tip
If your ID is expired or you plan to renew it soon, a new document number makes a leaked image less useful for some fraud. It does not make the old image harmless, so keep the credit freeze in place.
The bottom line
The Discord breach was smaller than the attackers claimed but more serious than a typical email leak, because government IDs cannot be reset. It became the main argument against ID based age checks, and it pushed Discord toward methods that avoid storing ID images. Whether those methods hold up is the test for every platform now being pushed to verify ages.
FAQ
How many Discord users had government IDs exposed?
Discord says about 70,000 users may have had government ID photos exposed. The attackers claimed about 2.1 million ID images, a figure Discord called inaccurate and part of an extortion attempt.
When did the Discord data breach happen?
Attackers accessed a third party customer support system on September 20, 2025. Discord disclosed the breach on October 3, 2025 and updated its findings on October 8.
What information was leaked in the Discord breach?
ID photos from age appeals, names, usernames, email and contact details, IP addresses, support messages and limited billing data such as payment type and the last four card digits. Discord says passwords and full card numbers were not exposed.
Was Discord itself hacked?
Discord says its own systems were not compromised. The breach hit a customer support platform run by an outside vendor, which Discord later named as 5CA. 5CA denied its systems were hacked and pointed to possible human error.
Did Discord pay the ransom?
No. The attackers reportedly demanded $3.5 million, and Discord said it would not reward those responsible and ended communication with them.
Does Discord still ask for ID photos for age verification?
Discord says it no longer uses the breached system. Its 2026 global age checks sort most users automatically and offer options such as an on device selfie, an app store age signal, a card check or an ID scan.
Sources
- SecurityWeek: Discord says 70,000 users had IDs exposed in recent data breach
- Cybernews: 5CA denies third party Zendesk platform was cause of Discord breach
- Cyber Security News: Discord data breach exposes sensitive data
- EFF: Discord voluntarily pushes mandatory age verification despite recent data breach
- TechCrunch: Discord delays global rollout of age verification after backlash
- Techlicious: Discord’s global age check rollout begins this week
- FTC: IdentityTheft.gov
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
