Discord is once again facing serious scrutiny after a hacker claimed responsibility for a massive data breach that exposed millions of internal support tickets, user information, and even government IDs — including those belonging to minors. The individual behind the attack has allegedly demanded millions of dollars from the platform, threatening to release the stolen data if Discord refuses to pay.
1.6TB of Internal Data Stolen
According to the hacker, over 1.6 terabytes of internal Discord support data were exfiltrated during the breach. This includes more than two million files, with sensitive information ranging from billing details and payment history to age-verification documents. Discord had previously described the breach as involving a “small number” of government IDs — around 70,000 — but the hacker insists the real figure is far higher.
Evidence shared by the individual includes screenshots from Discord’s internal support system, known as Zenbar, which reportedly contains user data such as location, email, and partial phone numbers. While Discord’s official statement minimized the scale, internal screenshots appear to confirm the presence of sensitive information beyond what was publicly acknowledged.
Billing and Phone Data at Risk
In addition to IDs, the hacker claims roughly 578,000 users’ billing information was compromised, representing an estimated $365 million worth of transactions. The stolen billing data allegedly includes PayPal emails, credit card providers, and expiration dates. Even more concerning, Discord’s internal API reportedly exposed full phone numbers — something the company never mentioned in its initial disclosure.
The hacker stated that the breach remained undetected for 58 hours, during which they were able to send over 60 million data requests through the platform’s internal tools without rate limits or alerts.
Hacker Demands $3.5 Million Ransom
The attacker reportedly contacted Discord, initially demanding $5 million, later reducing the ransom to $3.5 million. Discord allegedly ignored further communication, prompting the hacker to begin releasing data samples online to apply pressure. In their messages, the hacker warned that failure to meet their demand would result in the leak or sale of the full dataset — including IDs belonging to minors.
The situation escalated when predators began contacting the hacker through Telegram, suggesting that child IDs could be sold for profit, an alarming development that could have devastating real-world consequences.
A Risk to Minors and Victims of Exploitation
If the leaked material contains real government IDs and identifiable information of underage users, it could fuel blackmail, doxing, and exploitation. Cybersecurity analysts have raised concerns that such data could empower online predators, allowing them to locate, contact, or extort young Discord users directly.
This potential fallout highlights one of the platform’s longest-running issues: Discord’s inability to manage child safety effectively, even after multiple public incidents and prior breaches involving its support infrastructure.
Discord’s Security Under Fire — Again
This marks at least the third major breach involving Discord’s support systems since 2023. The attack reportedly originated through a third-party contractor that handles customer support operations. Once the hacker gained access to a single agent account, they allegedly faced no internal safeguards, no rate limits, and no automatic lockdowns — allowing unrestricted access to user data for more than two days.
While Discord has since confirmed that a vendor was compromised, many users are calling for greater transparency, arguing that critical personal data such as IDs should never be stored for extended periods after verification.
A Dangerous Precedent
Cybersecurity experts warn that paying ransoms could encourage further attacks, but Discord’s refusal to negotiate may also leave millions of users exposed. If the hacker follows through with their threat, the platform could face one of the most damaging leaks in its history — one that would not only erode trust but potentially endanger its youngest users.
For now, Discord has yet to provide additional clarification on the alleged 1.6TB breach, and users are urged to monitor their accounts closely for suspicious activity or potential identity misuse.
Youtube Source: NoTextToSpeech
