This Discord feature you barely noticed could now be your biggest privacy risk

"Around 70,000 Discord users may have had images of their government IDs stolen, according to an update from the company. Last week, the popular chat platform notified users that the third-party vendor the platform uses for customer service was hacked, affecting Discord users who had interacted with the app's customer support or trust and safety teams. Discord initially announced last week that an unauthorized group gained access to a "small number" of government ID images."

"That includes images of sensitive documents like driver's licenses, passports and potentially even selfies of people holding those documents - a common way to verify identity for online accounts. On Wednesday, the company updated its blog post with the estimated number of users affected. While 70,000 users is a small sliver of the chat app's 200 million monthly users, it's still a large swath of people who now have very good reason to be worried about identity theft."

"Beyond government ID images, the hackers may have gained access to Discord users' names, usernames, emails and contact information, the last four digits of credit cards linked to accounts, IP addresses and messages with customer service agents. The hacking group stole the documents explicitly in an effort to "extort a financial ransom," Discord disclosed in its blog post. "As soon as we became aware of this attack, we took immediate steps to address the situation," Discord said in a newly updated blog post."

Approximately 70,000 Discord users may have had images of government-issued IDs stolen after a third-party customer service vendor was hacked. Stolen materials include driver's licenses, passports, and selfies of users holding documents used for identity verification. Hackers may also have accessed names, usernames, emails, contact information, last four credit card digits, IP addresses, and messages exchanged with customer service agents. Full credit card numbers, CCV codes, passwords, and non-support-related Discord messages were not compromised. Discord revoked the vendor's ticketing access, launched an internal investigation, hired a computer forensics firm, and engaged law enforcement. The hacking group sought to extort a financial ransom.

Read at Fast Company