Discord data breach explained: what happened to government-ID photos?
Key takeaways
- Discord says an incident involving a third-party customer-service provider may have exposed information belonging to users who contacted its Customer Support or Trust & Safety teams.
- In its statement updated on 9 October 2025, Discord identified approximately 70,000 users globally whose government-ID photos may have been exposed.
- This is a guide to that 2025 incident. It should not be mistaken for confirmation of a new Discord breach in October 2026.
The short answer
Discord says an incident involving a third-party customer-service provider may have exposed information belonging to users who contacted its Customer Support or Trust & Safety teams.
In its statement updated on 9 October 2025, Discord identified approximately 70,000 users globally whose government-ID photos may have been exposed.
This is a guide to that 2025 incident. It should not be mistaken for confirmation of a new Discord breach in October 2026.
What did Discord say happened?
Discord said an unauthorised party compromised a third-party service provider, 5CA, used for customer-service support. The attacker gained access to information connected with some support interactions.
The company distinguished that event from a breach of Discord itself. It said it revoked the provider's access to its ticketing system, engaged a computer-forensics firm and involved law enforcement.
The approximately 70,000 figure concerns users whose government-ID images may have been exposed during age-related appeals. It is not a statement that every Discord user's ID was leaked, or a complete count of everyone whose support information was affected.
What information may have been involved?
Discord's statement lists:
The company said a notification would specify if the recipient's ID may have been accessed.
- Names, usernames, email addresses and other contact details supplied to support.
- Limited billing information, including payment type, the last four card digits and purchase history where associated with an account.
- IP addresses.
- Messages exchanged with customer-service agents.
- Government-ID images connected with some age-related appeals.
What was not involved?
According to Discord, the incident did not involve:
A support conversation is different from a private conversation elsewhere in Discord. Reporting should preserve that distinction rather than imply the attacker obtained everyone's chats.
- Full credit-card numbers or card security codes.
- Passwords or authentication data.
- Messages or activity on Discord beyond material users discussed with support.
How can you check whether you were affected?
Discord's incident statement said affected users would receive an email from noreply@discord.com, and that it would not contact them about this incident by telephone.
That describes Discord's notification process at the time. It is not a promise of a fresh email today. Review any genuine notice you already received, particularly its description of the information involved.
Do not rely on a sender's display name alone. If you are uncertain, open Discord's official support website yourself rather than following an unexpected link or supplying more identity documents to someone who approaches you.
What should you do if your ID may have been exposed?
Keep the genuine notice and check which document or information it identifies. If an identity document was involved, ask the issuing authority about its fraud-reporting and replacement guidance. Procedures vary by country and document.
Watch for messages that refer to a support ticket, claim an urgent age-verification problem or request a security code. Do not send money or credentials to someone claiming they can delete leaked records.
Use a unique password and enable available multi-factor authentication. Those are protective steps, not evidence that passwords were taken in this incident.
What privacy services can and cannot do
Reducing publicly available personal information can limit what strangers find about you elsewhere. It does not retrieve an ID image from an attacker or erase a historical breach.
Our data-breach action guide explains wider precautions. You can also run a free ProtectMyData scan to understand other exposure. The scan does not verify whether you were affected by this particular Discord incident.
How to read the dates in this report
This explainer was prepared on 13 October 2026 from Discord's statement published on 3 October 2025 and updated on 9 October 2025. The article date is not the incident date.
The statement describes possible exposure and the company's response. It does not establish that every potentially affected record was stolen or that an identity document has subsequently been misused.
At a glance
| Information | What Discord said |
|---|---|
| Government-ID photos | May have been exposed for approximately 70,000 users globally. |
| Support interactions | Some contact details, limited billing information, IP addresses and support messages may have been involved. |
| Passwords and full card numbers | Excluded from the incident described. |
Check the notice before taking action
Review any genuine Discord notice and the specific information it identifies.
Open official support yourself instead of trusting an unexpected link.
Ask the document issuer for local guidance if your government ID was involved.
Use the notice to choose your next step
A practical response sequence, not a measurement of exposure or a claim that fraud occurred.
- Verify the genuine Discord notice
- Identify the specific information involved
- Follow official support or document-issuer guidance
Frequently asked questions
Is this a new Discord breach in 2026?
No. This explainer concerns Discord's statement published on 3 October 2025 and updated on 9 October 2025.
Were all Discord users' government IDs exposed?
Discord identified approximately 70,000 users globally whose ID photos may have been exposed. This does not mean every Discord user's ID was leaked.
Can a privacy scan confirm I was affected?
No. Check Discord's genuine notification for your affected information. A privacy scan does not verify inclusion in this incident or retrieve leaked ID images.
Sources
Related privacy guides
- What to do after a data breach
Practical, information-specific precautions.
- How dark web monitoring works
Understand alerts and the limits of monitoring.
More on Data Breaches & Dark Web
- Your Data Was in a Breach: Here's Exactly What to Do Next
Verify a breach notice, identify what was exposed and secure the right accounts. Practical steps for passwords, payment details and identity information.
- Dark Web Monitoring: What It Is and Do You Actually Need It?
What monitoring alerts mean, why a clear result is not a guarantee and how to act on exposed credentials without confusing monitoring with removal.
About the author
Scam awareness guides. Practical privacy and scam-awareness guidance from ProtectMyData, with links to the official sources used for each guide.