Discord, the popular communication platform with over 200 million active users, has confirmed a data breach after hackers gained access to customer support data through a third-party service provider.
What Happened
The breach occurred on September 20, when an unauthorized party accessed a customer service system used by Discord’s Trust & Safety and Support teams.
- Discord immediately revoked the provider’s access, isolated the affected system, and launched an investigation with law enforcement and forensics experts.
The attack appears to be financially motivated, with the hackers demanding ransom in exchange for not leaking the stolen data.
What Data Was Exposed
The breach exposed sensitive personal and financial information, including:
- Full names, usernames, and email addresses
- IP addresses, messages, and attachments sent to support
- Government-issued IDs (passports, driver’s licenses) for some users
- Partial payment information (card type, last 4 digits, purchase history)
Security researchers described the stolen dataset as potentially “entire identities” — highly valuable to criminals conducting fraud or crypto scams.
Who’s Behind the Attack?
While initially attributed to the Scattered Lapsus$ Hunters (SLH) group, conflicting statements later suggested another hacking group was responsible.
The breach reportedly originated from a Zendesk system integration used by Discord.
Broader Context
This incident follows a wave of supply-chain-style breaches targeting SaaS and cloud platforms.
Last month, ShinyHunters claimed access to 1.5 billion Salesforce records across 760 companies, further underscoring the risks associated with third-party integrations.
Discord’s Response
Discord states that the compromised provider has been disconnected and the breach contained. The company is notifying affected users and advising them to remain vigilant for phishing and identity theft.
This breach underscores how third-party integrations remain one of the weakest links in cybersecurity.
At Alcaeus Services, we help organizations strengthen supply chain security through vendor risk assessments, continuous monitoring, and incident response planning — reducing exposure to indirect attacks like this.
