More information about the extent of the Discord customer support breach has come to light.
Roughly 70,000 Discord users had images of their government-issued IDs exposed after attackers infiltrated a third-party customer support system used by the company. The breach, which the hackers claim affected millions more, has led to ransom demands that Discord says it will not pay.
The breach shows the growing danger of mandatory online ID verification. As governments push platforms to collect government-issued IDs for age checks and compliance, sensitive data ends up stored across multiple systems, often including third-party vendors users never interact with directly.
The attackers, who say they stole over 1.6 terabytes of data, allege that they accessed Discord’s Zendesk-based support platform for 58 hours starting on September 20, 2025.
They claim their entry point wasn’t a software vulnerability but the compromised account of a support agent working for an outsourced vendor. From there, they say they were able to extract personal information tied to around 5.5 million unique users.
Discord strongly disputes both the scope of the breach and the way it’s being portrayed. The company maintains that the incident was limited to a third-party service provider and did not impact its own systems directly.
The hackers argue that Discord is withholding the true extent of the exposure.
They claim to have exfiltrated 1.5 terabytes of ticket attachments and over 100 gigabytes of ticket transcripts, with roughly 8.4 million support tickets pulled from the platform.
They also suggest that around 580,000 users had records that included some form of payment information.
Though the hackers say they cannot confirm the exact number of government IDs stolen, they pointed to over 520,000 age-verification tickets as evidence that the total exceeds the company’s reported figure.
Questions remain about Discord’s handling of identity documents, including why government IDs were retained after age verification was completed. The company has not offered further clarification beyond its original statement.
