Inevitable? Discord data breach exposes 70,000 government IDs through age verification hack

Discord has said that 70,000 of the messaging platform’s users may have had their government IDs exposed, due to the hacking of a third-party service Discord used in relation to age verification.

Personal data submitted to the customer service software Zendesk, a Discord vendor, was reportedly compromised in September 2025. Discord told The Verge that the at-risk government IDs had been submitted to their vendor in relation to age-related appeals.

Discord said that names, usernames, email addresses, IP addresses and the last four digits of credit card numbers may also have been affected by the breach. All things that could be catnip to potential scammers.

On Discord, to access servers marked as ‘18+’ or ‘NSFW’ you need to confirm that you are aged 18 or over. If your account information lists you as aged under 18, or if Discord otherwise detects that you are under 18, you can be restricted from these servers.

You can appeal age blocks by submitting government ID to a third-party vendor via Discord, to show that you are indeed aged 18 or over.

Discord said that after the breach was discovered it revoked the customer support provider’s access to the messaging platform’s ticketing system, and launched an internal investigation. It added that it would “not reward” those responsible for the hack, who Discord said tried to extract ransom money from the company.

The data breach comes at a time when use of third-party vendors to manage age verification for access to adult content is surging. Critics of new tough age verification laws implemented in countries including the UK and Australia have repeatedly warned that such rules may place user data at risk from exposure.

Discord said it would “continue to frequently audit our third-party systems to ensure they meet our security and privacy standards”.

After tougher age verification rules were implemented in the UK in July, many major porn sites lost huge amounts of traffic, while some smaller sites that allegedly didn’t follow age verification rules had traffic spikes.