Wednesday

when

April

Discord

Concordium

Discord is reportedly being extorted by hackers responsible for breaching a database containing the sensitive age verification data of more than 2.1 million users, who are threatening to leak it.
In a Wednesday X <a href="https://x.com/vxunderground/status/1975834621503062495" rel="noopener noreferrer nofollow" target="_blank">post</a>, malware repository VX-Underground claimed Discord is being extorted by the individuals responsible for compromising their Zendesk instance, which contains user data. The data includes 2,185,151 photos used for the age verification of 2.1 million users, including pictures of driver’s licenses and passports.
“Discord users drivers license and/or passport might be leaked, “ VX-Underground said.
The breach occurred on Sept. 20, when Discord’s Zendesk instance containing the data was compromised. On Friday, the gaming-oriented messaging platform <a href="https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service" rel="noopener noreferrer nofollow" target="_blank">disclosed</a> the incident, claiming that “this incident impacted a limited number of users.”
<figure><img alt="2.1M Discord users’ ‘deleted’ ID photos may be exposed in massive leak" src="https://s3.cointelegraph.com/uploads/2025-10/0199c3ae-39c5-748d-a5d7-c02c3dbb04c2" title="">
 <figcaption style="text-align: center;">Source: <a href="https://x.com/vxunderground/status/1975834621503062495" rel="noopener noreferrer nofollow" target="_blank">VX-Underground</a>
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/news/verification-age-blockchain" rel="noopener noreferrer nofollow" target="_self">Age verification has made a colossal misstep, and blockchain needs to get involved</a>
<h2 id="a-small-number-of-id-images">“A small number of ID images”</h2>
“The unauthorized party also gained access to a small number of government‑ID images (e.g., driver’s license, passport) from users who had appealed an age determination,” Discord claimed, promising to warn affected users via email.
Some users have raised an issue with the data being stored, as Discord <a href="https://support.discord.com/hc/en-us/articles/30326565624343-How-to-Complete-Age-Verification-on-Discord" rel="noopener noreferrer nofollow" target="_blank">promised</a> that age verification data was “deleted directly after your age group is confirmed.” Still, the data source is not the age verification system but the photos sent to the helpdesk when appealing a ruling made by the automated age verification system.
<figure><img alt="2.1M Discord users’ ‘deleted’ ID photos may be exposed in massive leak" src="https://s3.cointelegraph.com/uploads/2025-10/0199c3a8-550c-7862-bdfa-638cff17cdb3" title="">
 <figcaption style="text-align: center;">Discord age verification screen. Source: Discord
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/news/compliance-cost-your-privacy" rel="noopener noreferrer nofollow" target="_self">Compliance isn’t supposed to cost you your privacy</a>
<h2 id="the-dangers-of-age-verification">The dangers of age verification</h2>
Many cybersecurity and privacy advocates strongly oppose the imposition of document checks for online service age verification. The reason is that when large quantities of sensitive data are stored on a server, it becomes an attractive target for malicious actors, as in this case.
Some in the crypto and cryptography world are claiming that there are safer alternatives. In late August, layer-1 proof-of-stake blockchain Concordium launched a mobile application that allows users to <a href="https://cointelegraph.com/news/concordium-launches-zero-knowledge-age-verification-app" rel="noopener noreferrer nofollow" target="_self">verify their age without disclosing their identity</a>.
The application relies on <a href="https://cointelegraph.com/explained/zero-knowledge-proofs-explained" rel="noopener noreferrer nofollow" target="https://cointelegraph.com/explained/zero-knowledge-proofs-explained">zero-knowledge proofs (ZK-proofs)</a> to mathematically verify that users have provided proof of their age, without disclosing the full details. This would prevent the accumulation of large numbers of photos of documents on a server that can be breached at a later time.
Systems that use ZK-proofs do not have to rely on cryptocurrencies. Google Wallet, the search giant’s payment and digital card management application, said in late April that it had&nbsp;<a href="https://blog.google/products/google-pay/google-wallet-age-identity-verifications/" rel="noopener noreferrer nofollow" target="https://blog.google/products/google-pay/google-wallet-age-identity-verifications/">integrated</a>&nbsp;ZK-proofs for age verification.
Magazine: <a href="https://cointelegraph.com/magazine/crypto-zero-knowledge-voting-finance/" rel="noopener noreferrer nofollow" target="_self">Beyond crypto: Zero-knowledge proofs show potential from voting to finance</a>

2.1M Discord users’ ‘deleted’ ID photos may be exposed in massive leak

Table of Contents

Cointelegraph

Other articles published on Oct 8, 2025

Join our free newsletter for daily crypto updates!