Discord says hackers stole images of 70,000 users' government IDs, which they were required to provide to use the site.
Like a growing number of sites, Discord requires certain users to provide a photo or scan of their driver's license or other government-issued ID showing they meet the minimum age requirements in their country. In some cases, Discord allows users to prove their age by submitting a selfie that shows their face (it's not clear how a face proves someone's age, but there you go). The social networking site imposes these requirements on users who, as reported by other users, do not exceed the minimum age set for the country from which they are connecting.
“Significant risk of identity theft”
Wednesday Discord said that the ID images of approximately 70,000 users “may have been exposed” in a recent hack of the third-party service Discord, which was tasked with managing the data. Affected users contacted Discord's customer support or trust and safety teams and then provided their IDs for age-related appeals.
“We recently discovered an incident where one of Discord's third-party service providers was compromised by an unauthorized party,” the company said on Wednesday. “The unauthorized party then gained access to information from a limited number of users who contacted Discord through our customer service and/or trust and safety teams.”
Discord has blocked an unnamed vendor from accessing its ticketing system after learning of the hack. The company is now sending emails to affected users. Notifications will be sent from [email protected]. Discord said it will not contact affected users by phone.
The data breach is a sign of things to come as more and more sites require users to surrender their official IDs as a condition of using their services. Additionally, Discord, Roblox, Steam, and Twitch have also required some of their users to provide photo ID. Laws passed in 19 US states, FranceThe UK and other countries now require porn sites to confirm that visitors are of legal age to view adult content. Many sites complied, but not all.
