Last week, it was reported that a third-party platform that handles customer service data for Discord was hacked, resulting in the leak of numerous age-verifying photo IDs.
The extent of the damage is initially unknown as Discord only notified affected people privately, but widespread speculation has emerged online.
The popular X (formerly Twitter) account vx-underground claimed that up to 2.1 million users had their data exposed, equivalent to 1.5TB of passport and other identification documents. However, Discord spokesperson Nu Wexler denied this information, asserting that the scale of the incident was exaggerated, and that only about 70,000 users were actually affected.
In a statement to The Verge, Wexler said:
'Following last week's announcement of a security incident involving a third-party customer service provider, we want to clarify some of the false claims circulating online.
First, as stated in the blog post, this was not a data breach from Discord, but from a third-party service we use for customer support.
Second, the numbers shared are inaccurate and part of an attempt to extort money from Discord.
Globally, we've identified approximately 70,000 users who may have had their ID photos used by the provider for age verification exposed.
Third, we will not make concessions to those behind this criminal activity.'
Wexler also stressed that all affected users have been notified and that Discord is cooperating with law enforcement. The company has also terminated its contract with Zendesk, the customer support provider that was hacked in the incident, and has re-secured the affected systems to prevent further data breaches.
However, the incident is still considered very serious, because the leaked data includes emails, photos of ID cards, the last four digits of credit cards, IP addresses and many other sensitive personal information.