Discord data breach: a customer service vendor, support tickets and about 70,000 ID photos

Date	Event
September 20 to 22, 2025	Unauthorized access to Discord's customer service platform; attacker removed September 22
September 25, 2025	Discord discovers the incident
October 3, 2025	Discord's public statement; emails to affected users begin
October 9, 2025	Statement updated: about 70,000 users may have had ID photos exposed
February 6, 2026	Report to Massachusetts (2026-183): 283 residents

What happened in the Discord breach?

The letter Discord filed in Massachusetts says it found on September 25, 2025 that a third party had reached its customer service platform through a compromised vendor device. Discord revoked the customer support provider's access, brought in a digital forensics firm and notified law enforcement.

Its public statement names the vendor. Discord says this was not a breach of Discord but of a third-party service provider, 5CA, that it used for customer service. It also gives the motive: the unauthorized party went after the outsourced support service to get user data, with a view to extorting a ransom from Discord. Neither document says whether a ransom was paid.

Were Discord ID photos leaked?

Some ID images were reached. Discord's update of October 9 puts the number at about 70,000 users worldwide whose government-ID photos may have been exposed. Those were images users had sent to appeal an age decision on their account, and the vendor used them to review those appeals. The statement says that if a user's ID may have been accessed, the email they get will say so. The Massachusetts row marks driver's licenses and nothing else. So for the 283 Massachusetts residents, the ID photo is the regulated item. Social Security numbers, financial accounts and full card numbers are not marked.

What information did the Discord breach expose?

What sat in the support system. The Massachusetts letter lists name, contact details given to Discord, Discord username, date of birth, a photo of a driver's license or other government ID if one was provided, and limited payment information: payment type, the last four digits of a card, and purchase or refund history. It adds IP addresses and the messages and attachments users sent to support agents. The public statement says nothing beyond those support conversations was reached: no other messages or activity on Discord.

Record	People	Data it marks
Discord statement, October 9, 2025 update	about 70,000 worldwide with ID photos	Support contact data, last four card digits, ID images
Massachusetts OCABR, report 2026-183	283	Driver's licenses

Is the Discord breach email real?

Discord says its emails about this incident come only from noreply@discord.com and that it will not phone anyone about it. The letter that followed the email says the recipient may have received the email around October 3. Any message about this incident from another address, or any phone call, is not from Discord. Because the stolen data includes support conversations, a scammer can quote a user's own ticket back to them, so that detail alone does not prove a message is genuine.

What is Discord offering?

The letter offers 12 months of Experian IdentityWorks credit monitoring at no cost. Questions go to dis.gd/support or privacy@discord.com. For someone whose ID photo was exposed, watching for new accounts opened in their name matters more than credit alerts alone. The guide to letters from a company you never dealt with explains vendor breaches like this one, where the company you know is writing about a provider you never saw. For how offers compare, see the credit monitoring guide.

What the documents leave open

• How the 5CA device was compromised, and who the attacker was.
• Whether Discord paid or refused the ransom demand.
• The total number of users whose support data, rather than ID photos, was reached.