Discord has reported a security incident resulting from a hack of one of its third-party support providers.
According to the company, an "unauthorized party" gained access to the information of a "limited number of users" who contacted the support service. Discord noted that the attackers' goal was to demand a financial ransom for the stolen data. It is reported that they did not gain direct access to the Discord platform itself.
Potentially compromised data includes nicknames, usernames, email addresses, IP addresses, support correspondence, and the last 4 digits of credit card numbers. In addition, a "small number" of government ID images were obtained from users who challenged age verification. Full card numbers and passwords were not affected, the company said.
Discord is currently sending out emails to affected users. If an ID has been compromised, the email will include a clarification.
The company has also revoked the vendor's access to the case management system, reported the incident to data protection authorities, is cooperating with law enforcement, and has reviewed its threat detection and security controls for third-party partners.