Discord / 5CA Data Breach - Revision history

Banana: Added archive URLs for 1 citation(s) using CRWCitationBot

2026-02-16T04:26:20Z

Added archive URLs for 1 citation(s) using CRWCitationBot

← Older revision		Revision as of 04:26, 16 February 2026
Line 13:		Line 13:

	== Background ==		== Background ==
	In 2023, the UK government passed the [[UK Online Safety Act\|Online Safety Act]]. In 2025, the Online Safety Act was amended to require platforms to verify the age of its users when they try to access content considered harmful to children.<ref name=":2">{{Cite web \|date=April 24, 2025 \|title=Online Safety Act: explainer \|url=https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer \|website=Gov.uk}}</ref>		In 2023, the UK government passed the [[UK Online Safety Act\|Online Safety Act]]. In 2025, the Online Safety Act was amended to require platforms to verify the age of its users when they try to access content considered harmful to children.<ref name=":2">{{Cite web \|date=April 24, 2025 \|title=Online Safety Act: explainer \|url=https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer \|website=Gov.uk \|url-status=live \|archive-url=http://web.archive.org/web/20260212093923/https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer \|archive-date=12 Feb 2026}}</ref>

	Discord implemented age verification in 2025. A user could verify their age using face scanning or by uploading a picture of their government-issued ID. If the face scan does not correctly determine the user's age as old enough, using their ID becomes the only option to confirm their age.<ref>{{Cite web \|last=Rahman-Jones1 Vallance2 \|first=Imran1 Chris2 \|date=2025-04-17 \|title=Discord's face scanning age checks 'start of a bigger shift' \|url=https://www.bbc.co.uk/news/articles/cjr75wypg0vo \|url-status=live \|archive-url=https://web.archive.org/web/20251230081436/https://www.bbc.co.uk/news/articles/cjr75wypg0vo \|archive-date=2025-12-30 \|access-date=2026-01-10 \|website=BBC}}</ref>		Discord implemented age verification in 2025. A user could verify their age using face scanning or by uploading a picture of their government-issued ID. If the face scan does not correctly determine the user's age as old enough, using their ID becomes the only option to confirm their age.<ref>{{Cite web \|last=Rahman-Jones1 Vallance2 \|first=Imran1 Chris2 \|date=2025-04-17 \|title=Discord's face scanning age checks 'start of a bigger shift' \|url=https://www.bbc.co.uk/news/articles/cjr75wypg0vo \|url-status=live \|archive-url=https://web.archive.org/web/20251230081436/https://www.bbc.co.uk/news/articles/cjr75wypg0vo \|archive-date=2025-12-30 \|access-date=2026-01-10 \|website=BBC}}</ref>

Bythmusters: added cargo

2026-01-31T20:07:35Z

added cargo

← Older revision		Revision as of 20:07, 31 January 2026
Line 1:		Line 1:
			{{IncidentCargo
			\|Company=5CA, Discord
			\|StartDate=2025-10-03
			\|EndDate=
			\|Status=
			\|ProductLine=
			\|Product=Discord
			\|ArticleType=
			\|Type=Data, ID, Privacy
			\|Description=
			}}
	On 3rd October 2025, [[Discord]] published a press release stating that one of their third-party service providers, later revealed to be [[5CA]], was the target of a data breach. Discord states that they have identified around 70,000 users that may have been impacted by having images of their government ID taken.<ref name=":0">{{Cite web \|date=2025-10-03 \|title=Update on a Security Incident Involving Third-Party Customer Service \|url=https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service \|url-status=live \|archive-url=https://web.archive.org/web/20251220165327/https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service \|archive-date=20 Dec 2025 \|access-date=2025-10-13 \|website=Discord}}</ref>		On 3rd October 2025, [[Discord]] published a press release stating that one of their third-party service providers, later revealed to be [[5CA]], was the target of a data breach. Discord states that they have identified around 70,000 users that may have been impacted by having images of their government ID taken.<ref name=":0">{{Cite web \|date=2025-10-03 \|title=Update on a Security Incident Involving Third-Party Customer Service \|url=https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service \|url-status=live \|archive-url=https://web.archive.org/web/20251220165327/https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service \|archive-date=20 Dec 2025 \|access-date=2025-10-13 \|website=Discord}}</ref>

OskaRRRitoS: Initial write-up for this incident

2026-01-10T21:34:16Z

Initial write-up for this incident

New page

On 3rd October 2025, [[Discord]] published a press release stating that one of their third-party service providers, later revealed to be [[5CA]], was the target of a data breach. Discord states that they have identified around 70,000 users that may have been impacted by having images of their government ID taken.<ref name=":0">{{Cite web |date=2025-10-03 |title=Update on a Security Incident Involving Third-Party Customer Service |url=https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service |url-status=live |archive-url=https://web.archive.org/web/20251220165327/https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service |archive-date=20 Dec 2025 |access-date=2025-10-13 |website=Discord}}</ref>

== Background ==
In 2023, the UK government passed the [[UK Online Safety Act|Online Safety Act]]. In 2025, the Online Safety Act was amended to require platforms to verify the age of its users when they try to access content considered harmful to children.<ref name=":2">{{Cite web |date=April 24, 2025 |title=Online Safety Act: explainer |url=https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer |website=Gov.uk}}</ref>

Discord implemented age verification in 2025. A user could verify their age using face scanning or by uploading a picture of their government-issued ID. If the face scan does not correctly determine the user's age as old enough, using their ID becomes the only option to confirm their age.<ref>{{Cite web |last=Rahman-Jones1 Vallance2 |first=Imran1 Chris2 |date=2025-04-17 |title=Discord's face scanning age checks 'start of a bigger shift' |url=https://www.bbc.co.uk/news/articles/cjr75wypg0vo |url-status=live |archive-url=https://web.archive.org/web/20251230081436/https://www.bbc.co.uk/news/articles/cjr75wypg0vo |archive-date=2025-12-30 |access-date=2026-01-10 |website=BBC}}</ref>

== Incident ==
Discord stated in a press release that an unauthorized party compromised 5CA, one of the customer service vendors used by Discord, stealing data that was shared by users with their Customer Support. Discord states that they themselves were not breached.

The data involved in the breach was:

* Name, Discord username, email, and other contact details provided to Discord customer support
* Limited billing information such as payment type, last four digits of credit card, and purchase history
* IP addresses
* Messages with customer service agents
* Images of users' government IDs

Discord states that around 70,000 users may have had their government ID exposed.<ref name=":0" />

5CA denied that they were hacked, stating that they do not handle government-issued IDs. They admit that the data breach may have involved human error from one of their employees but deny that the breach involved any of their systems or other clients.<ref>{{Cite web |last= |first= |date=14 October 2025 |title=Holding Statement Regarding Security Incident |url=https://5ca.com/blog/holding-statement-security-incident/ |url-status=live |archive-url=https://web.archive.org/web/20251219030045/https://5ca.com/blog/holding-statement-security-incident/ |archive-date=2025-12-19 |access-date=2026-01-10 |website=5CA}}</ref>

BleepingComputer reported to have contacted the hackers involved in the data breach. The alleged hackers claimed that they were able to access the data via Zendesk and collected around 1.6TB of data concerning around 5.5 million users. They claim that Discord understated the amount of users who had their government ID exposed as they found around 521,000 tickets relating to age verification. BleepingComputer could not verify the hackers' claims.<ref>{{Cite web |last=Abrams |first=Lawrence |date=2025-10-08 |title=Hackers claim Discord breach exposed data of 5.5 million users |url=https://www.bleepingcomputer.com/news/security/hackers-claim-discord-breach-exposed-data-of-55-million-users/ |url-status=live |archive-url=https://web.archive.org/web/20251206212912/https://www.bleepingcomputer.com/news/security/hackers-claim-discord-breach-exposed-data-of-55-million-users/ |archive-date=2025-12-06 |access-date=2026-01-10 |website=BleepingComputer}}</ref>

== References ==
<references />