In brief
Discord, a platform with over 200 million users, announced a possible leak of official ID photos for approximately 70,000 users following a cyber attack on an age verification contractor. The company's own systems were not breached, but personal information, partial credit card details, and customer service interactions may have been exposed. Discord is cooperating with law enforcement while assuring that no full credit card details or passwords were compromised. The investigation continues amidst claims that the breach's scale has been understated.
Discord, a messaging platform popular with gamers, says official ID photos of around 70,000 users have potentially been leaked after a cyber-attack.
The platform, which has more than 200 million users worldwide, says hackers had targeted a firm that helped to verify the ages of its users but the Discord platform itself was not breached.
People can provide ID photos to verify their age on Discord - a networking hub for players to chat and share files with others in the gaming community.
The leaked data may involve personal information, partial credit card details, and messages that were exchanged with Discord's customer service agents, the San-Francisco-based company says.
No full credit card details, passwords, or messages and activity beyond conversations with Discord's customer support agents were leaked, the firm said.
All impacted users have been contacted and Discord is working with law enforcement to investigate the matter, it added.
The platform said it has revoked the customer support provider's access to the system that was targeted in the breach. Discord did not name the third-party company involved.
A representative from Zendesk, a customer service software provider for Discord, told the BBC that its systems had not been compromised and that the breach did not result from a vulnerability within its platform.
Some online commentators have claimed that the data breach was bigger than Discord has revealed.
A spokesperson for Discord told the BBC that those claims are inaccurate and part of an attempt to extort payment. The spokesperson said the breach was not a ransomware attack.
We will not reward those responsible for their illegal actions, the spokesperson added.
Cybercriminals frequently target personal data, which can command a high price on the black market for use in scams.
Information like full names and official ID numbers is especially valuable because, unlike credit card details, it typically remains unchanged over time.
Discord has previously strengthened its age-verification measures in response to concerns that some servers on the platform were being used to distribute pornographic and extremist material.
