Discord Data Breach Involving Compromised Government ID Photos and Third-Party Denial

Discord experienced a significant data breach that resulted in the exposure of approximately 70,000 users' government-issued identification photos, including driver's licenses and passports submitted for age verification. The breach was initially disclosed by Discord, which stated that a 'small number' of government IDs had been compromised, later clarifying that the number was around 70,000. Discord attributed the breach to a third-party customer service support firm, 5CA, which it contracts for customer support operations. However, 5CA publicly refuted these claims, asserting that none of its systems were involved in the breach and that it had not handled government-issued IDs for Discord. 5CA emphasized that its platforms and systems remained secure, with all client data protected under strict security controls, and that there was no evidence of impact on other clients or systems. The company also stated that access controls, encryption, and monitoring systems were fully operational and had been placed under heightened review as a precaution. 5CA attributed the incident to 'human error' but did not provide further details on the nature of this error. Media reports and statements from 5CA suggest that the breach occurred outside of its infrastructure. Hackers claiming responsibility for the breach told BleepingComputer that they accessed Discord's Zendesk account for 58 hours on September 20, allegedly using compromised credentials belonging to a support agent from a third-party company. This suggests that the attack vector may have involved credential compromise rather than a direct hack of 5CA's systems. Discord has not yet confirmed which company was responsible for holding the compromised government ID photos. The incident has raised concerns about the security of third-party vendors and the handling of sensitive user data. Both Discord and 5CA have faced scrutiny over their security practices and communication regarding the breach. The lack of clarity about the exact cause and responsible party has left users and the cybersecurity community seeking more information. The breach underscores the risks associated with outsourcing customer support functions and the importance of robust access controls and monitoring. Discord's response included updating its public statements and working to clarify the scope and impact of the breach. 5CA's denial and emphasis on its security posture highlight the challenges in attributing responsibility in incidents involving multiple vendors. The incident remains under investigation, with both companies maintaining that their systems were not directly compromised. The exposure of sensitive government ID photos has significant privacy implications for affected users. Ongoing reviews and heightened security measures have been implemented by 5CA as a precaution. The breach serves as a reminder of the persistent threat posed by compromised credentials and the need for continuous vigilance in third-party risk management.