Discord ID Theft Hits 70,000 Users After Vendor Breach

Discord just admitted hackers grabbed government IDs from 70,000 users. The culprit? A third-party customer service vendor that got compromised.

This isn’t just another breach. It’s a warning shot about what happens when websites demand your driver’s license to prove you’re old enough to use their platform. Plus, Discord won’t be the last company to lose this kind of data.

How the Breach Happened

Discord requires certain users to submit government IDs when other users report them as potentially underage. The company uses a third-party vendor to handle these age verification submissions through customer support tickets.

Hackers broke into that vendor’s systems. Then they accessed ID images from users who had contacted Discord’s Customer Support or Trust & Safety teams for age-related appeals.

Discord cut off the vendor’s access immediately after discovering the breach. Now they’re emailing affected users from [email protected]. However, the company stressed they won’t call anyone about this incident.

The exposed IDs include driver’s licenses and other government documents showing birth dates, addresses, and face photos. In some cases, Discord also collected selfies for age verification, though it’s unclear how a face photo actually proves someone’s age.

The Growing ID Verification Problem

Discord isn’t alone in demanding government IDs. Roblox, Steam, and Twitch also require photo IDs from some users. The trend keeps accelerating.

Why? Laws in 19 US states, France, the UK, and other jurisdictions now force porn sites to verify visitors meet minimum age requirements. Many adult sites complied. But some, like Pornhub, chose to block access from these regions instead.

Pornhub’s reasoning makes sense. They argued that age verification software creates “substantial risk for identity theft” and opens doors for data breaches. Moreover, governments historically struggle to secure sensitive data.

The site also pointed out that criminals exploit age verification through phishing attempts and fake verification processes. So requiring IDs normalizes handing over personally identifiable information across the internet.

What Makes This Data Valuable to Hackers

Stolen government IDs are worth serious money on dark web markets. Hackers can use them for identity theft, financial fraud, or creating fake accounts.

But there’s a darker angle. When ID data links to specific services, especially taboo ones, its value skyrockets. Extortion becomes possible. Imagine someone threatening to expose your Pornhub usage along with your real name, address, and face photo.

Discord users who submitted IDs for age verification now face this exact risk. Their government documents sit in criminal hands, potentially alongside their Discord usernames and activity.

Even Fortune 500 companies get breached regularly. So smaller third-party vendors handling sensitive data for multiple clients make juicy targets. Plus, these vendors often lack the security resources of major corporations.

What You Can Do Now

If you’ve submitted an ID to Discord or any other platform, assume it’s been or will be stolen. That’s not paranoia. It’s reality in 2025.

Discord advises affected users to “stay alert when receiving messages or other communication that may seem suspicious.” However, that’s weak advice when teenage hackers can steal credentials just by asking nicely.

VPNs help mask your location to avoid age verification requirements. But sites increasingly block VPN IP addresses. So that protection won’t last forever.

The best option? Stop using services that demand government IDs. I know that’s not always practical. But it’s the only way to avoid this specific threat entirely.

Watch for phishing emails claiming to be from Discord about this breach. Legitimate notifications come from [email protected], and Discord won’t call you. Scammers will absolutely exploit this breach to steal even more data.

Monitor your credit reports. Set up fraud alerts. Consider freezing your credit if your ID was exposed. These steps won’t prevent all damage, but they limit what criminals can do with stolen identity documents.

Nobody Asked for This Mess

Here’s what bugs me. Age verification laws sound reasonable on paper. Protecting minors from inappropriate content makes sense as a goal.

But in practice, these laws just created massive honeypots of sensitive data. Now hackers target the companies storing millions of government IDs. Plus, the data often connects to services people want to keep private.

Discord had good intentions requiring IDs for age verification. Yet they outsourced the actual handling to a third party that got compromised. So users who tried to follow the rules now face identity theft risk.

The real winners? Hackers who just scored 70,000 government IDs they can sell or exploit. The real losers? Regular people who trusted Discord to protect their most sensitive documents.

Expect more breaches like this. As more sites demand IDs, more vendors will store them, and more hackers will steal them. That’s not pessimism. It’s just math.