91探花

Discord has confirmed that hackers gained access to user information through a third-party customer service provider, not through Discord鈥檚 own systems. The company said on 3 October that one of its external vendors, 5CA, was compromised in what appeared to be an extortion attempt.

Around 70,000 users around the world may have had copies of their government ID photos exposed. The vendor had collected those IDs to verify ages for people appealing account restrictions. The hackers also accessed names, emails, IP addresses, parts of payment details and chat records between users and customer service agents.

Discord reacted quickly after spotting the breach. It revoked 5CA鈥檚 access, brought in digital forensics experts and contacted law enforcement. It is now emailing affected users directly. The company said no one鈥檚 passwords, full credit card numbers or private Discord messages were touched.

Why Are Hackers Going After Age Checks?

What happened to Discord鈥檚 vendor fits into a pattern that鈥檚 been growing for months. More platforms are collecting ID data because governments are tightening rules on what young people can see online. But each new age verification database turns into a goldmine for hackers.

Aliya Bhatia from the Centre for Democracy and Technology said the breach 鈥渓ays bare the privacy risks鈥� of these systems. Even companies trying to use less invasive methods end up gathering ID images when people challenge automated decisions. Once those IDs are in storage, they鈥檙e a target.

The Electronic Frontier Foundation has warned that online age checks are nothing like showing an ID card at a shop. Once a copy exists online, it鈥檚 permanent and easily misused. Without strong privacy laws, those databases can become surveillance tools or be sold on. In short, a rule meant to protect children often ends up exposing everyone else.

What Does This Say About Privacy Laws?

Age verification laws are being introduced faster than governments can agree on how to keep that data safe. The result is a mess of rules that force companies to collect personal details without an actual limit on how that information should be handled.

Tom McBrien from the Electronic Privacy Information Centre said there are safer ways to prove age online, like using credit card ownership or trusted digital tokens. He mentioned how when laws make ID uploads mandatory, they should also force companies to follow strict data security rules, with fines when they fail.

He added that a strong federal privacy law could fix many of these problems through 鈥渄ata minimisation鈥�, meaning firms would have to collect less in the first place. But since Congress hasn鈥檛 passed such a law, each platform has been left to build its own version of compliance. That means millions of ID photos sitting in scattered systems, all vulnerable in their own way.

What Will Discord Be Doing?

Discord said it鈥檚 tightening security checks for all its external providers and working with law enforcement to trace the breach. The company warned users to ignore suspicious messages and confirmed that any contact about the incident will come from “[email protected].”

For those affected, the leak should be showing us all, just how fragile online privacy has become. Many people hand over IDs to appeal false age bans, not expecting that data to be held by a contractor halfway across the world.

As Bhatia put it, the problem is bigger than one company. Every new ID requirement chips away at online anonymity, turning what used to be casual browsing into a data trail. The Discord case shows how trying to make the internet safer for children can end up making it less private for everyone else.