Discord says that between September 20 and 22, 2025, an unauthorized third party gained access to its customer service platform through a compromised vendor device. The company describes this as a third-party vendor breach: the intruder didn’t break into Discord’s own systems directly, but into a device belonging to an outside customer support provider that had access to Discord’s support tools. Discord discovered the intrusion on September 25, 2025, revoked the support provider’s access, hired a digital forensics firm, and notified law enforcement. The company states it has found no evidence so far that the exposed data has actually been misused.
This notice is directed at Discord users whose information passed through that customer service platform, which typically means people who had submitted a support ticket, an age or identity verification request, or a Trust & Safety report. The letter is addressed to an individual recipient and does not include an aggregate count of how many people were notified in total.
What information was exposed?
- Full name
- Address, phone number, and/or email address on file
- Discord username
- Date of birth
- A photo of a driver’s license or other state/government-issued ID, if one was submitted
- Limited payment information, including payment type, the last four digits of a credit card, and purchase or refund history
- IP addresses
- Messages and attachments sent to Discord’s Customer Support or Trust & Safety agents
Discord is offering affected users 12 months of complimentary credit monitoring and identity restoration through Experian IdentityWorks. The enrollment form included with the letter had placeholder fields for the enrollment deadline, sign-up website, and activation code, so check your own copy of the letter for the specific URL, code, and cutoff date that apply to you.
What should you do now?
- Enroll in the free Experian IdentityWorks credit monitoring using the activation code and link included in your letter, before the enrollment deadline listed there.
- If a photo of your driver’s license or ID was involved, contact your state’s DMV or ID-issuing agency to ask about a fraud flag or replacement, since a scanned ID can be used to open accounts in your name.
- Place a fraud alert or a security freeze on your credit files with Equifax, Experian, and TransUnion, especially given the combination of date of birth, ID photo, and payment details involved.
- Watch your existing card statements for unfamiliar charges, and consider requesting a new card number if you’re uneasy about the last-four-digits exposure.
- Be extra cautious of phishing emails or messages that reference your real Discord account details, since scammers sometimes use breached data to make fake messages look legitimate.
- Because this incident involves government ID, date of birth, and financial details together, consider signing up for a service like Aura or LifeLock, which can alert you if your information appears elsewhere.
- Review your Discord account’s login history and connected devices, and change your password if you haven’t recently.
If you have questions, Discord can be reached at 833-918-7475, [email protected], http://dis.gd/support, or by mail at 444 De Haro Street, Suite 200, San Francisco, CA 94107.