Discord discord.com Discord data breach: what happened and what to do
In September 2025 an attacker got into 5CA, a customer support vendor Discord used. Discord says about 70,000 users may have had government ID photos exposed, plus names, usernames, emails, limited billing details, IP addresses and support messages. Discord itself was not breached.
View all 13,115 breaches- Breach date
- 20 Sept 2025
- Made public
- 8 Oct 2025
- Affected
- 70,000
- Data exposed
- Names, Usernames, Email addresses, Government issued IDs, IP addresses
- Last updated
Discord was not hacked directly. The breach happened at 5CA, an outside company that handled customer support tickets for Discord. An unauthorized party got into the vendor's systems around September 20, 2025, according to the California Attorney General's listing and press coverage, and Discord disclosed it in early October.
What happened
Discord said the attacker compromised the third-party provider, not Discord's own systems. Once it learned of the incident, Discord says it revoked the vendor's access to its ticketing system, started working with law enforcement and began emailing the people affected. Discord later said it no longer works with that vendor. It also said the age verification companies it uses were not involved.
The numbers deserve a careful read. Discord's headline figure is about 70,000 users who may have had government ID photos exposed. Those were images people submitted when they appealed an age determination, such as a driver's license or passport. In the detailed list, Discord describes the ID exposure as a small number of images, so the 70,000 figure is the upper estimate of who may be affected, not a confirmed count of stolen IDs. Press reports said the attackers demanded a ransom and Discord refused to pay. Treat that as reported, not confirmed by Discord.
What was exposed
Discord's notice lists the following for people who contacted support or Trust and Safety:
- Names, Discord usernames and email addresses
- Other contact details given to support
- Limited billing information, such as payment type and the last four digits of a card
- IP addresses
- Messages with customer service agents
- Government ID images, for users who appealed an age determination
Discord says full credit card numbers and passwords were not part of it. Security Affairs, which relayed that point, reports the same.
What that lets criminals do
A government ID photo is the most serious item. It carries your full name, date of birth, photo and document number, which is enough to try to open accounts, pass weak identity checks or build a convincing impersonation. Your email and username, combined with the text of a real support conversation, make phishing very believable: a message that mentions your actual ticket looks like it came from Discord. The last four digits of a card help scammers sound legitimate on a phone call.
What to expect next
Discord is emailing people it believes were affected. Be careful with that email: scammers copy breach notices. Don't click links in a message about the breach. Open Discord directly and check your account, or go to Discord's own help center. If you appealed an age determination or sent an ID to Discord support in 2025, assume your ID image is in the affected group even if you haven't seen an email.
Is there anything Discord can't undo?
A leaked ID can't be recalled. The practical protection is to make it hard to use: freeze your credit, watch your accounts and treat any unexpected message mentioning Discord or your ID with suspicion.
What to do if you were in it
- 1
Treat any message about the breach as suspect
Scammers send fake Discord breach notices. Don't click links or open attachments. Open the Discord app or type the address in yourself, and only trust notices that match what's in your account.
- 2
Change your password and turn on 2FA
Passwords weren't reported as exposed, but a new unique password and two-factor authentication on Discord cost you two minutes. Change it anywhere you reused it.
- 3
Freeze your credit at all three bureaus
A credit freeze stops anyone from opening new credit in your name. It's free and takes about 10 minutes at each of Equifax, Experian and TransUnion. You can lift it for a day when you apply for a loan. If you sent Discord a driver's license or passport, this is the most important step.
- 4
Watch for phishing and scam calls that mention your support ticket
Your email, username, IP address and past support messages were exposed. Expect messages that quote them. If someone claims to be Discord, hang up or close the message and contact Discord through the app.
- 5
Check your bank and card statements
Billing details were limited to the payment type and last four digits, but scammers can use those to sound real. Report anything you don't recognize to your card issuer.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one early.
Frequently asked
Was I affected by the Discord breach?
Discord says it is emailing affected users. Those most at risk contacted Support or Trust and Safety in the period around September 2025, or sent an ID when appealing an age determination. If you never contacted support, Discord's notice suggests you are unlikely to be included.
Was Discord itself hacked?
No. Discord says the breach was at 5CA, a third-party customer support provider, and that its own systems were not compromised.
How many people were affected?
Discord says about 70,000 users may have had government ID photos exposed. Its detailed notice describes the number of ID images accessed as small, so treat 70,000 as the upper estimate.
Should I change my Discord password?
Discord says passwords weren't part of the exposed data, but changing it and turning on two-factor authentication is a cheap precaution, especially if you reuse the password elsewhere.
Sources
- discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service
- securityaffairs.com/183039/data-breach/discord-discloses-third-party-breach-affecting-customer-support-data.html
- malwarebytes.com/blog/news/2025/10/discord-warns-users-after-data-stolen-in-third-party-breach
- oag.ca.gov/privacy/databreach/list
Something wrong or out of date? Tell us and we'll re-check it.
