ID photos of 70,000 users may have been leaked, Discord says

"Discord, a messaging platform popular with gamers, says official ID photos of around 70,000 users have potentially been leaked after a cyber-attack. The platform, which has more than 200 million users worldwide, says hackers had targeted a firm that helped to verify the ages of its users but the Discord platform itself was not breached. People can provide ID photos to verify their age on Discord - a networking hub for players to chat and share files with others in the gaming community."

"The leaked data may involve personal information, partial credit card details and messages that were exchanged with Discord's customer service agents, the San-Francisco-based company says. No full credit card details, passwords, or messages and activity beyond conversations with Discord's customer support agents were leaked, the firm said. All impacted users have been contacted and Discord is working with law enforcement to investigate the matter, it added."

"The platform said it has revoked the customer support provider's access to the system that was targeted in the breach. Discord did not name the third-party company involved. A representative from Zendesk, a customer service software provider for Discord, told the BBC that its systems had not been compromised and that the breach did was not caused by a vulnerability within its platform. Some online commentators have claimed that the data breach was bigger than Discord has revealed."

Approximately 70,000 Discord users' official ID photos were potentially exposed following a cyber-attack on a third-party firm used for age verification. Discord's own platform was not breached, and no full credit card numbers, passwords, or messages beyond customer support interactions were exposed. Leaked items may include personal information, partial credit card details, and exchanges with Discord support agents. Discord has contacted affected users, revoked the targeted provider's access, and is cooperating with law enforcement. Zendesk stated its systems were not compromised and Discord characterized amplified claims as extortion attempts rather than ransomware.

Read at www.bbc.com