Discord disclosed that images of government IDs submitted by users for age verification may have been exposed in a breach of a third-party provider it used to handle support data.
Like many platforms, Discord requires some users to upload ID photos or scans (or in some cases selfies) to confirm they meet minimum age requirements for their country. The company noted it is unclear how a selfie proves age, but did not dispute its use in certain checks.
Discord said an unauthorized party gained access to information from a limited number of users who contacted its Customer Support or Trust & Safety teams, then submitted IDs in review of age-related appeals. The vendor’s access to Discord’s ticketing system was cut off once the breach was discovered. Affected users are being notified by email from noreply@discord.com.
Industry-wide trend: this incident underscores a broader shift toward ID-based verification as more sites require official IDs, a trend tied to age-verification laws in various regions. Other platforms such as Roblox, Steam, and Twitch have also adopted photo-ID requirements in different forms.
User guidance: individuals should monitor accounts for suspicious activity and consider identity-theft protections. Discord has pledged support and updates as it clarifies the scope of the breach.
