Loading story…
Discord confirmed that bugs in its automated security and moderation pipeline wrongly suspended more than 8,400 user accounts between May and early July. The company said its automated detection systems falsely flagged legitimate users, leading to about 8,200 accounts being affected from May through the final week of June, with roughly 200 additional accounts impacted over the following weekend.
A second failure prevented approved unban actions from being applied after Trust & Safety staff had cleared those accounts, prolonging the suspensions for some users. Discord said all affected accounts have now been restored, but it has not disclosed the precise technical remediation or whether impacted users will receive additional communication or compensation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Discord stated that all accounts affected by the erroneous suspensions have now been restored. The company did not disclose the exact technical fix or whether affected users would receive further communication or compensation.
Discord said roughly 200 more accounts were impacted over the following weekend, bringing the total number of wrongly suspended accounts to more than 8,400 between May 2026 and early July 2026.
Discord said bugs in its automated security and moderation pipeline falsely flagged legitimate accounts and also prevented some approved unban actions from being applied. The company said roughly 8,200 accounts were affected between May 2026 and the final week of June 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcecyberaccord.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers gained unauthorized access to a third-party customer service system used by Discord, resulting in the exposure of sensitive user data. The breach, which occurred on September 20, 2025, did not compromise Discord’s core infrastructure but targeted a helpdesk provider that managed customer support and Trust and Safety interactions. The attackers obtained personally identifiable information, including real names, Discord usernames, email addresses, and IP addresses of users who had contacted Discord’s support teams. In addition to contact details, the breach exposed partial payment information, such as the last four digits of credit cards and payment types, as well as purchase history for some users. Notably, a subset of affected users had submitted government-issued identification documents, such as driver’s licenses and passports, for account appeals or age verification, and these scanned IDs were also accessed by the attackers. The attackers demanded a ransom from Discord, threatening to leak the stolen information if their demands were not met, indicating a financially motivated campaign. Discord responded by immediately revoking the support provider’s access to its ticketing system, launching an internal investigation, and engaging a leading computer forensics firm to assist with remediation. Law enforcement agencies were also notified and involved in the investigation. The company publicly disclosed the incident and notified affected users, emphasizing that full credit card numbers and account passwords were not compromised. The breach highlights the risks associated with storing sensitive data, such as government IDs, in third-party systems, especially as regulatory requirements push platforms to collect more personal information for age verification. Security experts note that customer support platforms often become attractive targets for cybercriminals due to the concentration of sensitive user data. The incident underscores the importance of minimizing data retention and ensuring that sensitive information is not stored longer than necessary in support systems. Discord’s experience mirrors previous breaches at other major platforms where helpdesk systems were exploited to access user data. The company’s swift response aimed to contain the breach and prevent further unauthorized access. The exposure of government-issued IDs is particularly concerning, as it increases the risk of identity theft for affected users. The breach serves as a cautionary tale for organizations relying on third-party vendors to handle sensitive customer interactions. Ongoing investigations are expected to provide further insights into the attackers’ methods and the full scope of the compromised data. Discord has committed to reviewing and strengthening its data handling and vendor management practices in the wake of the incident.
Jun 29, 2026
Discord experienced a significant data breach that resulted in the exposure of approximately 70,000 users' government-issued identification photos, including driver's licenses and passports submitted for age verification. The breach was initially disclosed by Discord, which stated that a 'small number' of government IDs had been compromised, later clarifying that the number was around 70,000. Discord attributed the breach to a third-party customer service support firm, 5CA, which it contracts for customer support operations. However, 5CA publicly refuted these claims, asserting that none of its systems were involved in the breach and that it had not handled government-issued IDs for Discord. 5CA emphasized that its platforms and systems remained secure, with all client data protected under strict security controls, and that there was no evidence of impact on other clients or systems. The company also stated that access controls, encryption, and monitoring systems were fully operational and had been placed under heightened review as a precaution. 5CA attributed the incident to 'human error' but did not provide further details on the nature of this error. Media reports and statements from 5CA suggest that the breach occurred outside of its infrastructure. Hackers claiming responsibility for the breach told BleepingComputer that they accessed Discord's Zendesk account for 58 hours on September 20, allegedly using compromised credentials belonging to a support agent from a third-party company. This suggests that the attack vector may have involved credential compromise rather than a direct hack of 5CA's systems. Discord has not yet confirmed which company was responsible for holding the compromised government ID photos. The incident has raised concerns about the security of third-party vendors and the handling of sensitive user data. Both Discord and 5CA have faced scrutiny over their security practices and communication regarding the breach. The lack of clarity about the exact cause and responsible party has left users and the cybersecurity community seeking more information. The breach underscores the risks associated with outsourcing customer support functions and the importance of robust access controls and monitoring. Discord's response included updating its public statements and working to clarify the scope and impact of the breach. 5CA's denial and emphasis on its security posture highlight the challenges in attributing responsibility in incidents involving multiple vendors. The incident remains under investigation, with both companies maintaining that their systems were not directly compromised. The exposure of sensitive government ID photos has significant privacy implications for affected users. Ongoing reviews and heightened security measures have been implemented by 5CA as a precaution. The breach serves as a reminder of the persistent threat posed by compromised credentials and the need for continuous vigilance in third-party risk management.
Jun 29, 2026
**Discord** announced a phased global rollout requiring users to verify their age using **video selfies or government IDs**, citing growing regulatory pressure for age checks on social platforms and a goal of providing a “teen-appropriate experience by default.” Discord said the verification data will be **deleted immediately after age is confirmed** and claimed it **will not leave the user’s device**; the company also described new defaults that restrict access to age-gated features (e.g., blurring sensitive content and limiting age-restricted channels/commands to verified adults). The rollout is expected to begin in early March, following earlier “teen-by-default” measures introduced in the U.K. and Australia. The policy change triggered backlash in gaming communities due to privacy and breach concerns, amplified by a prior incident in which **roughly 70,000 images of government IDs** were exposed after users had uploaded them for customer service purposes; reporting attributes the exposure to a **third-party service** Discord used to manage data. Discord is attempting to reassure users by pointing to tightened controls and a partnership with *k-ID* for age checks, but critics highlighted perceived ambiguity in how ID scans may be handled (including potential uploads to vendor servers and involvement of additional third parties), and warned that expanding collection of sensitive identity data increases the platform’s attractiveness as a target.
Jun 29, 2026