Discord has confirmed a significant data breach affecting users who interacted with its customer support teams, after hackers compromised a third-party service provider on September 20. The attack exposed a range of personally identifiable information (PII), including names, email addresses, messages, and, for a small number of users, photos of government-issued IDs such as passports and driver’s licenses. Partial billing details and payment histories were also affected.
According to the post-mortem, the threat actors—believed to be the Scattered Lapsus$ Hunters (SLH) group—claimed responsibility and demanded a ransom from Discord in exchange for not leaking the stolen data. While Zendesk is suspected to be the compromised vendor, this detail has not yet been officially confirmed. Investigators noted that the stolen data contains “people’s entire identity,” a statement underscoring the potential for identity theft, account hijacking, or crypto-related fraud if the information circulates on dark web marketplaces.
Discord responded by isolating and revoking access for the affected vendor, initiating a comprehensive forensic investigation, and notifying law enforcement and all impacted users. The company also enlisted a third-party cybersecurity firm to assess the extent of the breach and prevent future incidents.
While the total number of affected accounts remains undisclosed, the breach underscores the risks of third-party dependencies and highlights how vendor security continues to be a major weak point in digital ecosystems. As threat groups increasingly exploit supply-chain and service provider vulnerabilities, platforms like Discord face mounting pressure to reassess vendor access, authentication mechanisms, and data retention practices.
This breach serves as a cautionary case for all SaaS operators: security responsibility doesn’t end at your own perimeter—it extends to every partner in your network.
#Discord #databreach #cybersecurity #PII #infosec #LapsusHunters #Zendesk #identitytheft #ransomware #privacybreach #thirdpartysecurity #supportbreach #supplychainattack #cyberattack #DarkWeb
