Hackers Threaten to Release Personal IDs of 2.1 Million Discord Users in Extortion Scheme

Hackers have reportedly accessed and stolen over two million images of government-issued identification from Discord's third-party support platform. They are now threatening to publicly release this sensitive data unless Discord pays a ransom.

Key Takeaways:

Hackers have stolen over 2 million personal identification images from Discord's third-party support system.
Discord confirms a breach of its Zendesk instance but claims its own servers remain unaffected.
The stolen data poses risks of identity theft and phishing attacks, despite the absence of certain sensitive information.
The incident has prompted discussions about data handling practices and has fueled public opposition to a proposed national Digital ID program in the UK.
Law enforcement is currently investigating the breach, while Discord is reviewing its external vendors to enhance security measures.

Hackers Threaten to Leak 2.1M Discord Users’ Passports, Licenses in Extortion Attack

The cyber breach took place on September 20 and involved the Zendesk platform used by Discord for customer support and trust-and-safety inquiries.

Extensive Data Theft: Over 2.1 Million IDs at Risk

Cybersecurity group VX-Underground reports that the attackers claim to have stolen 1.5 terabytes of data, which includes approximately 2,185,151 images submitted by Discord users for age verification purposes. These images typically include users' passports and driver’s licenses, submitted for identity verification after being flagged by Discord's automated moderation system.

"Chat, we are cooked. Discord is being extorted by the people who compromised their Zendesk instance. They've got 1.5TB of age verification-related photos. 2,185,151 photos. tl;dr 2.1m Discord users' driver’s licenses and/or passports might be leaked. Unknown number of email addresses." — vx-underground (@vxunderground) October 8, 2025

On October 3, Discord acknowledged in a blog update that an "unauthorized party" had breached its third-party Zendesk instance but noted that this incident affected only a "limited number of users" who had interacted with their support teams. The company stated that its own servers remained secure, and no user passwords, private messages, or authentication information were compromised.

However, the attackers' claims suggest a much larger problem. VX-Underground shared screenshots of alleged stolen ID images, asserting that Discord is being threatened with extortion to prevent these documents from being revealed.

"On September 20, Discord experienced a security incident involving its customer service platform. This incident led to the exposure of users’ names, usernames, email addresses, limited payment information, IP addresses, and messages exchanged with customer service." — Discord Previews (@DiscordPreviews) October 3, 2025

Besides the theft of images of identification documents, Discord has not verified the authenticity of the leaked samples but has acknowledged that some ID photos were accessed.

While Discord's disclosure aimed to downplay the severity of the breach, cybersecurity experts contend that the attackers might possess more than 2.1 million user verification images. They have also released samples of these documents to back their claims and reaffirmed that Discord is being blackmailed to prevent the data from being made public.

Despite the assurance that sensitive data like full credit card numbers and personal messages were not compromised, security experts caution that the stolen data could still be exploited for phishing attacks, identity theft, or social engineering scams.

"Update: We have been made aware that the attackers have claimed to have obtained 1.5 TB of age-verification photos totaling 2,185,151 images, which they are now using to extort Discord." — Discord Previews (@DiscordPreviews) October 8, 2025

The breach has reignited discussions about the management of identity verification data on digital platforms. Users have expressed their dissatisfaction online, especially since Discord had previously stated that age verification data would be deleted immediately after validation. Critics argue that retaining appeal-related documents unnecessarily increases privacy risks, especially when stored on external servers.

Implications of the Discord Breach on Digital ID Discussions

This incident emphasizes significant flaws in data handling practices: even when companies outsource operations like customer support, sensitive user information can remain vulnerable if external vendors do not adhere to stringent security protocols. In this case, the hackers seem to have directly targeted Discord’s Zendesk platform instead of its primary systems, exploiting access privileges tied to the external service.

The fallout from this event has also sparked broader discussions in the UK regarding plans for a national Digital ID program, as public opposition grows.

"I have received countless requests to campaign against digital ID. The petition, at 2.8 million signatures shows: This is no fringe view. It is a national outcry." — David Davis MP (@DavidDavisMP) October 8, 2025

Following the incident, a petition opposing the government's Digital ID initiative has gained more than 2.8 million signatures. Critics argue that such centralized identification systems that store extensive sensitive data pose significant risks, as evidenced by the Discord breach.

The incident also mirrors a trend of similar attacks targeting third-party service providers throughout the tech industry. Zendesk has become a recurrent point of exploitation in prior cyberattacks. Discord has stated that it is actively reviewing all external vendors and auditing permissions to prevent future breaches.

As of this week, extortionists have not disclosed a ransom amount or deadline for payment. Law enforcement agencies in both the U.S. and Europe are investigating the situation, but the authenticity of the hackers' claims and the full dataset remains unverified.

This breach comes at a time when data security and user privacy are at the forefront of discussions about digital identity. Last year, Privado ID, a venture from Polygon Labs, launched a web wallet that allows users to verify their age and identity using zero-knowledge proofs, a type of cryptographic method that confirms personal information without revealing the underlying data. This technology is viewed as a more privacy-conscious alternative to traditional document uploads, like those used during Discord's age verification process.