Government ID photos of about 70,000 global users of Discord, a popular messaging and chat platform among video gamers, may have been exposed after hackers compromised a company contracted to carry out age verification checks.<\/p>\n
Some users\u2019 names, email addresses and other contact details, IP addresses and messages with Discord\u2019s customer service agents may also have been taken. The attacker has been trying to extort a ransom from the company. No full credit card details or passwords were seized.<\/p>\n
The breach was made public last week but the potential number of lost photo IDs emerged on Wednesday. A spokesperson for the UK\u2019s Information Commissioner\u2019s Office, which regulates data breaches, said: \u201cWe have received a report from Discord and we are assessing the information provided.\u201d<\/p>\n
The photos that may have been taken were provided by users making age-related appeals to Discord\u2019s customer services contractor in cases where they may have been locked out of the decade-old platform, which allows people to hang out through text messaging or voice and video chat.<\/p>\n
Some countries, including the UK, require social media and messaging providers to carry out age checks to ensure child safety. In the UK this has been the case since July under the Online Safety Act<\/a>. Cybersecurity experts have warned of a risk that some providers of such checks, which can require government IDs, are becoming hacker targets with bad actors aware of the high volume of sensitive data.<\/p>\n \u201cRecently, we discovered an incident where an unauthorised party compromised one of Discord\u2019s third-party customer service providers,\u201d Discord said in a statement. \u201cThe unauthorised party then gained access to information from a limited number of users who had contacted Discord through our customer support and\/or trust and safety teams \u2026 Of the accounts impacted globally, we have identified approximately 70,000 users that may have had government ID photos exposed, which our vendor used to review age-related appeals.\u201d<\/p>\n Discord required people who needed to prove their age to get back on to the platform to upload an image of their photo ID and Discord username.<\/p>\n Nathan Webb, a principal consultant at the UK digital security company Acumen Cyber, said the breach was \u201cvery concerning\u201d.<\/p>\n skip past newsletter promotion<\/a><\/p>\n A weekly dive in to how technology is shaping our lives<\/p>\n Privacy Notice: Newsletters may contain information about charities, online ads, and content funded by outside parties. If you do not have an account, we will create a guest account for you on theguardian.com<\/a> to send you this newsletter. You can complete full registration at any time. For more information about how we use your data see our Privacy Policy<\/a>. We use Google reCaptcha to protect our website and the Google Privacy Policy<\/a> and Terms of Service<\/a> apply.<\/p>\n after newsletter promotion<\/p>\n \u201cDespite age verification being outsourced, businesses still have an accountability to ensure that data is stored appropriately,\u201d he said. \u201cIt\u2019s important for organisations to recognise that delegating certain processes does not absolve their responsibility to uphold data protection and security standards.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"Government ID photos of about 70,000 global users of Discord, a popular messaging and chat platform among video…\n","protected":false},"author":2,"featured_media":188489,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[84,59,56,54,55],"class_list":{"0":"post-188488","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-business","8":"tag-business","9":"tag-gb","10":"tag-uk","11":"tag-united-kingdom","12":"tag-unitedkingdom"},"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/188488","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=188488"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/188488\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/188489"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=188488"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=188488"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=188488"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}