We count eight notable Discord security incidents since 2023. The most serious was the October 2025 breach of a customer service vendor, which Discord says exposed government ID photos of about 70,000 users who had appealed an age decision. None was reported as a breach of Discord's own servers and no bulk leak of private DMs has been reported, but support messages, data from public servers, and data held by third-party bots and vendors have all been exposed.
Discord Security Incident Timeline
| Date | Incident | What was exposed | Type |
|---|---|---|---|
| Mar 2023 (disclosed May 2023) | A third-party customer support agent's account is compromised | Email addresses, support messages and attachments in the agent's ticket queue; about 180 users had sensitive personal information such as ID numbers exposed | Vendor breach |
| Aug 2023 | Discord.io, an unofficial custom-invite service, is breached | Usernames, email addresses and Discord IDs; for some users, billing addresses and bcrypt-hashed passwords (seller claimed 760,000 users) | Third-party service breach |
| Oct to Nov 2023 | Trellix reports malware using Discord's CDN and webhooks; Discord moves to expiring file links | No Discord data; Discord infrastructure abused to deliver malware and receive stolen credentials | Platform abuse |
| Apr 2024 | Spy.pet scrapes public servers and sells users' message histories | Messages and voice channel activity from servers the scraper's accounts joined (claimed 3 billion+ messages) | Scraping |
| Jun 2025 | Check Point reports expired invite links being hijacked to spread AsyncRAT and Skuld Stealer | Discord credentials, browser data and crypto wallets on infected victims' computers | Malware campaign |
| Sep to Oct 2025 | A customer service vendor is breached and Discord is extorted | About 70,000 government ID photos from age-related appeals, plus names, usernames, emails, IP addresses, partial billing data and support messages | Vendor breach |
| Feb 2026 | Researchers find an exposed frontend at Persona, a vendor in Discord's UK age-check test | Code and configuration; Persona says no personal data | Vendor exposure |
| Oct 2026 | Double Counter, a popular third-party moderation bot, is breached and its bot token hijacked | Discord IDs, usernames, email addresses, IP addresses and coarse location (operator says data tied to about 28 million accounts; 274,900 emails published) | Third-party app breach |
Sources: Discord's own disclosures and Help Center, BleepingComputer, 404 Media, Check Point Research, TechCrunch, Malwarebytes and Have I Been Pwned. Full list in Sources & References.
October 2025: Government IDs Exposed Through a Support Vendor
On 3 October 2025 Discord disclosed that an unauthorized party had compromised "one of Discord's third-party customer service providers" and accessed data on users who had contacted its Customer Support or Trust & Safety teams. Discord said the attacker's goal was "to extort a financial ransom from Discord." In an update a few days later, Discord named the provider as 5CA and gave a count: about 70,000 users may have had government ID photos exposed, which the vendor had used to review age-related appeals.
According to Discord, the data involved may include names, Discord usernames, email addresses and other contact details given to support, limited billing information (payment type, the last four digits of a card and purchase history), IP addresses, messages with customer service agents, and some internal training material. Discord said full card numbers, passwords and authentication data, and messages or activity on Discord beyond support conversations were not involved.
The attackers told BleepingComputer they had held access for 58 hours from 20 September, through a compromised account belonging to a support agent at an outsourcing company, and claimed data on 5.5 million users and 2.1 million ID photos. Discord called those numbers "incorrect" and part of the extortion attempt, and said it would not pay. 5CA disputed Discord's account, saying none of its systems were involved, that it had not handled government IDs for Discord, and that its preliminary view pointed to human error. Zendesk, whose software hosted the support queue, said its platform was not compromised.
Discord said it revoked the vendor's access to its ticketing system, brought in a forensics firm and law enforcement, notified data protection authorities, and emailed affected users from noreply@discord.com. It also said it would not contact anyone about the incident by phone. In February 2026 TechCrunch reported that Discord no longer works with that vendor.
Why this is an age verification story
The ID photos existed because of age checks. Laws such as the UK's Online Safety Act push platforms to confirm users' ages, and anyone who disputes an automated decision needs a fallback, which often means sending an ID to a support team. That fallback turned a support desk into a store of passports and driving licences. We cover the laws and the trade-offs in age verification laws in 2026.
In February 2026, researchers looking into Discord's age checks found a publicly reachable frontend belonging to Persona, an identity verification vendor Discord had tested in the UK. Persona said it was an isolated testing environment with no customer data, and Malwarebytes later updated its report to say no personal data was exposed. Discord said the Persona test had concluded. It then delayed its global age verification rollout to the second half of 2026 and said it would work only with vendors that perform age verification entirely on the user's device.
March 2023: A Support Agent's Account
The 2025 breach had a precedent. In May 2023 Discord emailed users to say a third-party support agent's account had been compromised, giving access to the agent's support ticket queue. Discord said the queue held email addresses, the contents of customer service messages and any attachments, and that it deactivated the account as soon as it learned of the issue, ran malware checks on the machine and worked with its support partner to prevent a repeat.
Later notices, reported by BleepingComputer in August 2023, said the compromise was detected on 29 March 2023, that Discord finished reviewing the tickets on 13 June, and that about 180 users had sensitive personal information exposed, including driver's licence or state ID numbers.
April 2024: Spy.pet and Scraped Public Servers
In April 2024, 404 Media reported on Spy.pet, a site that scraped Discord servers at scale and sold access to users' message histories, including which voice channels they joined, for as little as $5. The site claimed to track more than 14,000 servers, 600 million users and over 3 billion messages.
This was not a breach of Discord's systems. The scraper's accounts sat in servers that were open to anyone or had public invite links, and collected what any member could see. Discord said scraping and self-botting violate its Terms of Service and Community Guidelines, banned accounts it believed were affiliated with Spy.pet, and said it was "considering appropriate legal action." The site went offline soon after. The lesson for communities: anything posted in a public server should be treated as public, because one member account can copy all of it.
Malware, Token Theft and Account Takeovers
Most Discord account takeovers don't come from a breach at Discord. They come from malware and phishing on users' own devices. Discord's Help Center warns about links and files dressed up as games or Nitro giveaways that are "designed to steal your login credentials," and about scammers impersonating Discord staff.
In October 2023 Trellix reported that at least 10,000 malware samples used Discord's CDN to download second-stage payloads, and that 17 malware families, including AgentTesla and zgRAT, had used Discord webhooks since August 2021 to send stolen credentials, cookies and crypto wallet data back to attackers. In November 2023 Discord said it would make attachment links expire, so a file link shared outside Discord stops working after about 24 hours unless the Discord client refreshes it. That makes Discord a less reliable place to host malware.
Campaigns keep adapting. In June 2025 Check Point Research described attackers reclaiming expired or deleted invite links, including vanity links from servers that lost their boost, so that old links in forums and posts led to the attackers' servers instead. A fake verification bot sent visitors to a phishing page that tricked them into running a PowerShell command, which installed AsyncRAT and a modified Skuld Stealer aimed at Discord credentials, browser data and crypto wallets. Check Point said Discord quickly disabled the malicious bot.
Third-Party Bots and Services
Discord's open bot and app ecosystem means many companies hold Discord user data. Two breaches show the risk.
In August 2023, Discord.io, an unofficial service for custom invite links, confirmed a breach after its database was put up for sale. The seller claimed 760,000 users; the data included usernames, email addresses and Discord IDs, and for a small number of users, billing addresses and bcrypt-hashed passwords. Discord.io said it was "stopping all operations for the foreseeable future." It is not affiliated with Discord.
On 4 October 2026, Double Counter, a bot used to detect alt accounts in more than 600,000 communities, was breached. Its operator, Tellter SAS, said the attacker got in through an outdated Metabase instance on an old server that had never been shut down, copied about 12 GB from a database linked to about 28 million Discord accounts, including IP addresses and about 1 million full email addresses, and hijacked the bot's token to post invites to the attacker's server in large communities. Have I Been Pwned lists 274,900 unique email addresses in the data that was later published. Discord said "this was not a breach of Discord" and disabled new installs of the app while it investigated.
What These Incidents Have in Common
- Third parties hold the sensitive data. Three of the eight incidents involve vendors Discord hired (2023, 2025, 2026) and two involve independent bots or services. In none of them was Discord's core platform reported breached.
- Support desks are a target. Both support incidents began with a support agent's account, according to Discord in 2023 and the attackers in 2025. Support queues collect IDs, billing details and personal stories in one place.
- Anything a member can read can be copied. Spy.pet and bots with broad permissions show how much data flows to anyone inside a server.
- Credentials, not cryptography, are the weak point. Stolen tokens, hijacked bot tokens and phished logins account for most account takeovers.
Would end-to-end encryption have helped? Partly. Discord text messages are not end-to-end encrypted (see is Discord end-to-end encrypted?), so any tool or insider with server-side access to message stores could in principle read them. End-to-end encryption would keep message content out of reach of a compromised support tool or vendor that only touches the server. It would not have protected ID photos that users chose to send to a support team, stopped a scraper that joined a server as a member, prevented phishing, or protected a device already running malware, which can read whatever the user reads. Metadata such as usernames, emails and IP addresses would still be exposed in a vendor or bot breach.
What Discord Users and Server Admins Should Do
For users
- Turn on multi-factor authentication and use a strong, unique password, as Discord recommends.
- If you think your account is compromised, check your email first: Discord's "email address changed" message includes a link to revert the change. Then reset your password and file a report at dis.gd/hackedaccount.
- Review User Settings, Authorized Apps and deauthorize anything you don't recognize.
- Don't run files or click links offering Nitro giveaways, game tests or "verification". Discord says its staff never contact users through the app for support matters.
- Scan your computer for malware after any suspected takeover, because malware still on the device can steal your new login too.
- Think twice before sending an ID to any support team. If you must, ask how long it will be kept.
For server admins
- Audit bots: remove ones you no longer use and give the rest only the permissions they need. After a bot breach, check your audit log for unexpected posts or invites.
- Use permanent invite links, which Check Point found much harder to hijack, and update old links posted elsewhere.
- Assume content in public servers can be scraped, and keep sensitive discussion in small, invite-only spaces.
- For team or client work, use a tool where messages are end-to-end encrypted. Our two-factor authentication guide covers rolling out MFA across a team.
Frequently Asked Questions
Has Discord been hacked?
Discord's own systems have not been reported breached. Its customer support vendors were compromised in 2023 and 2025, and third-party services such as Discord.io and the Double Counter bot have been breached separately.
How many government IDs were exposed in the 2025 Discord breach?
Discord says about 70,000 users may have had government ID photos exposed. The attackers claimed 2.1 million, which Discord called incorrect and part of an attempt to extort it.
Were Discord messages leaked in the 2025 breach?
Discord says messages users exchanged with its customer service agents were involved, but not messages or activity on Discord beyond those support conversations. Passwords and full card numbers were not involved.
Was Spy.pet a Discord data breach?
No. Spy.pet scraped messages from servers its accounts could join, which Discord says violated its Terms of Service. Discord banned the accounts it linked to the site and said it was considering legal action.
Would end-to-end encryption have prevented these incidents?
Mostly not. It would keep message content away from compromised servers and vendor tools, but it does not protect IDs sent to support, data copied by members of a server, phished accounts or devices running malware.
Final Takeaway
Discord's record shows the risk sits around the platform more than in it: support vendors, bots and users' own devices. The biggest incident leaked identity documents collected for age checks, a warning for every service now asked to verify ages. If you compare options, our Lupyd vs Discord page sets out the differences. Lupyd end-to-end encrypts DMs (Signal Protocol), group channels (MLS) and files by default, though it is a young product, has not had an external security audit yet, and its group calls are not yet end-to-end encrypted. Try Lupyd.
Sources & References
- Update on a Security Incident Involving Third-Party Customer Service, Discord, 3 October 2025, updated 9 October 2025
- Hackers claim Discord breach exposed data of 5.5 million users, BleepingComputer, 8 October 2025
- The company Discord blamed for its recent breach says it wasn't hacked, Engadget, October 2025
- Discord delays global rollout of age verification after backlash, TechCrunch, 24 February 2026
- Age verification vendor Persona left frontend exposed, researchers say, Malwarebytes, 20 February 2026, updated 13 March 2026
- Discord discloses data breach after support agent got hacked, BleepingComputer, 12 May 2023
- Discord starts notifying users affected by March data breach, BleepingComputer, 23 August 2023
- Discord.io confirms breach after hacker steals data of 760K users, BleepingComputer, 14 August 2023
- Discord still a hotbed of malware activity, now APTs join the fun, BleepingComputer, 16 October 2023 (Trellix research)
- Discord will switch to temporary file links to block malware delivery, BleepingComputer, 4 November 2023
- A Spy Site Is Scraping Discord and Selling Users' Messages, 404 Media, 17 April 2024
- Discord drops the hammer on data-scraping 'Spy.pet' website, PC Gamer, April 2024
- From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery, Check Point Research, 12 June 2025
- Discord bot built to stop alt accounts leaks millions of users' IP addresses, Dexerto, October 2026 (summarising Tellter's incident report)
- Double Counter Data Breach, Have I Been Pwned, added 7 October 2026
- My Discord Account was Hacked or Compromised, Discord Help Center
Last updated: 7 November 2026.
- ✓ Discord has had eight notable security incidents since 2023, none reported as a breach of its own servers; most involved support vendors, third-party bots or malware on users' devices.
- ✓ In October 2025 a breach at a customer service vendor exposed government ID photos of about 70,000 users who had appealed age decisions, according to Discord; attackers claimed 2.1 million and tried to extort Discord.
- ✓ A support agent's account was also compromised in March 2023, exposing emails, support messages and attachments, including ID numbers for about 180 users.
- ✓ Spy.pet scraped public servers in 2024, and the Double Counter bot was breached in October 2026, showing how much data flows to anyone inside a server.
- ✓ End-to-end encryption would keep message content away from compromised servers and vendor tools, but not IDs sent to support, scraping by members, phishing or malware.
The workspace where nothing leaks
End-to-end encrypted channels and chat for your team, built on the Signal Protocol and MLS. Available on macOS, Windows, Linux and Android.
