Discord disclosed on Wednesday that a data breach had compromised the sensitive information of around 70,000 users. The breach occurred after hackers targeted a third-party vendor used by the platform for age-related appeals, exposing personal data, including government ID photos.
Users are asked to submit their selfie holding a government ID and Discord username to Discord’s Trust & Safety team when they need to make an age-related appeal. This usually happens when the platform suspects a user might be underage or when age verification is required for accessing the platform in certain regions.
Discord confirmed that affected users were notified of the breach, which may have exposed not only images of IDs but also IP addresses, potentially revealing users' general locations.
Hackers Claim Bigger Breach
While Discord has reported a breach affecting 70,000 users, 404 Media has suggested it may be larger than initially disclosed. The hackers involved in the breach claim to have stolen 1.5 terabytes of data, which could include more than just the 70,000 images. However, a Discord spokesperson told The Verge that these claims were “incorrect” and part of an extortion attempt.
Age Verification and Digital Rights Concerns
The breach has raised concerns among digital rights activists about the use of age verification checks, especially as a method to make the internet “safe.” Age verification laws have been enacted in about half of the U.S. states, usually for websites that host adult content. For instance, Pornhub blocked traffic from states requiring such age checks to avoid compliance.
In the UK, the Online Safety Act, which took effect in July, requires a broader array of platforms, including YouTube, Spotify, Google, X, and Reddit, to verify users' ages.
