As stated in Discord’s official statement addressing the breach, an “unauthorized party” compromised one of the platform’s third-party customer service providers, accessing information from a limited number of users who had contacted Discord’s Customer Support or Trust & Safety teams.

Due to this attack, the unnamed intruders obtained a number of government ID images, including driver’s licenses and passports, from some of the users who had appealed an age determination. In addition, the breach also resulted in the exposure of names, Discord usernames, emails, the last four digits of credit card numbers, purchase histories (if linked to the account), IP addresses, and messages with Discord’s customer service agents for some users.

The platform also clarified that more sensitive information, such as full credit card numbers or CVV codes, messages or activity on Discord outside of customer support interactions, and passwords or authentication data, was not impacted.