Discord users around the world are waking up to alarming emails confirming a major data breach that occurred on September 20, 2024. According to Discord, the incident stemmed from a compromise of a third-party customer service system — specifically Zendesk, which Discord uses to manage its support tickets.
While Discord insists that its main platform and age verification system (handled by third-party provider Yoti) were not directly affected, the customer support portal is another story entirely. This breach involves trust and safety communications, billing disputes, and manual age verification submissions, many of which contained sensitive personal data.
What Information Was Leaked
Based on Discord’s own disclosures and user reports, the exposed data includes:
- Full name and Discord username
- Email address and contact details
- Messages and attachments sent to Discord support or trust and safety
- IP addresses from support interactions
- Payment information (type, last four digits of card, and purchase history)
- Potentially government-issued IDs, such as driver’s licenses or passports
Discord’s email to affected users claimed that only a “small number” of IDs were accessed — but several users discovered that their ID documents were included in compromised tickets even though Discord’s notification didn’t mention it.
Worse still, users who filed DMCA takedowns through Discord’s legal portal may have had their full name and physical address leaked as part of the exposed support data.
Why This Breach Is Especially Serious
The attackers reportedly attempted to extort a ransom from Discord in exchange for the stolen data. While Discord did not confirm whether any ransom was paid, this indicates that cybercriminals now possess personal information belonging to countless users.
The risk extends far beyond Discord itself. Those whose IDs were leaked could face identity theft, credit fraud, and phishing attempts impersonating Discord. Even seemingly harmless details, such as your username and payment history, can be exploited to build convincing scams.
How to Check If You’re Affected
If you received a Discord email referencing the September 20 breach:
- Open the email and note the list of affected ticket numbers.
- Visit support.discord.com and sign in using the email that received the notification.
- Click on “My Activities” to view your past support tickets.
- Match the ticket numbers from the email with your account history.
- Review each ticket to see what personal information, attachments, or IDs were included.
If you find any documents containing personal or government ID information, assume it has been compromised — even if Discord’s message does not explicitly confirm it.
How to Protect Yourself
Here’s what to do if your data may have been exposed:
For Everyone
- Be cautious of phishing emails claiming to be from Discord or other companies.
- Enable two-factor authentication (2FA) on all important accounts.
- Avoid sharing any further personal information through Discord’s support channels for now.
If Your Payment Info Was Exposed
- Monitor your bank and credit card accounts for unauthorized charges.
- Consider requesting new cards as a precaution.
If Your Government ID Was Leaked
- Report the exposure to your local data protection authority.
- Monitor your credit report for new or suspicious activity.
- File a fraud alert if available in your country.
Legal Options
Users in the U.S. and Canada who accepted Discord’s new Terms of Service automatically agreed to an arbitration clause and class-action waiver, which limits legal action options. However, you can still opt out by emailing arbitration-opt-out@discord.com by October 29, 2024 to preserve your right to future legal recourse.
This Isn’t the First Time
This marks the second Discord support system breach in less than two years — the previous one occurred in May 2023 when a support agent’s account was compromised. Despite new security measures, the platform’s reliance on third-party tools like Zendesk continues to pose risks.
With growing regulatory demands for age verification systems and the widespread collection of personal documents, the risk of data leaks like this is only increasing. Users are urged to think twice before uploading sensitive information to online platforms, even for verification purposes.
Final Thoughts
This breach underscores the fragile balance between online safety regulations and user privacy. While governments push for stricter age verification, incidents like this prove that even the largest platforms are not immune to security lapses.
If you’ve submitted your ID, billing details, or private messages to Discord’s support system, treat your data as compromised — and take immediate steps to protect yourself.
