Discord says the recent data breach leaked 70,000 government-ID photos
A few days ago, Discord had revealed that one of its customer service providers had suffered a data breach. It had resulted in photos of government-ID photos being stolen by the attackers.
In its initial report, Discord had said that the hackers had gained access to "a small number" of government-ID images. However, an update to the statement says that about 70,000 photos of government-issued IDs were exposed. Sure, that's a small number.
VX Underground, which is known for its repository for malware samples for cybersecurity research, alleged that the Discord data breach was significantly larger. They claimed that attackers had targeted Zendesk, and compromised it, thus gaining access to 1.5TB of age verification related images. The total number was said to be 2.1 Million, more specifically, 2,185,151 images. This included driver licenses, passports, and may also have included an unknown number of email addresses. More importantly, the report claimed that Discord was being extorted by the attackers.
Discord has denied the data breach was so large. In a statement sent by spokesperson Nu Wexler to The Verge, Discord said that inaccurate claims are being circulated online. The company says approximately 70,000 users may have had their government-ID photos exposed. Discord also said that it would not reward those responsible for their illegal actions, meaning it would not pay the ransom.
Discord says all users who were impacted by the data breach have been notified of the attack, and that it is still investigating the matter with the help of law enforcement, security experts, and data protection authorities.
This security mishap has highlighted that age verification laws such as the U.K.'s Online Safety Act could not only pose privacy risks, but also expose user data to hacks. It only took a couple of months for hackers to gain access to a database containing images of personal identification documents, which was never supposed to exist in the first place. Discord had claimed that its support services would verify the age of users and immediately delete them, which, if it were true, would not have led to such an incident.
There are other options for discussion groups but most of them are extremely expensive. If you are a non-profit or underfunded organization with more than 100 members you cannot afford E2EE-capable tools like Slack or RocketChat, while messaging apps like Signal and Matrix just don’t do threaded discussions very well. Discord has stepped into this void with a nasty-looking, gamer-oriented, bloated offering that, despite newly incorporating E2EE, is as insecure as ever.
But what are the alternatives offering a Slack-like interface with these additional requirements?
1. free
2. uses e2ee
3. does not require self-hosting
4. no limits on users
For all its deficiencies, Discord does this. Kinda, sorta.
Unrelated question: has anyone used Jami?
I understand where you are coming from but ultimately I feel as though the days of Discord are well and truly over. Even if they implement some sort of Encryption it would have to be audited from many independent sources and the code would have to be up for viewing and scrutiny because as we all know at this point there have been many high profile instances of people using the service for ill deeds some of them more reprehensible than others and whilst I do not approve of such stupidity I do however feel that people’s right to privacy matters and as such if discord cannot and evidently in this case cover the basics then they are out and it will be better to advocate for a more suitable alternative. I feel as though Matrix may be headed in the direction to supplement Discord also however that might take some time.
I have tried Jami before but as with everything in this space I could not convince people to drop whatsapp or whatever else they were using at the time.
It does appear to have some promise however I have seen a few complaints from people claiming it was unreliable.
I will say it is superior to Teleguard (not be confused with Telegram) an app made by Swisscows that claims to be anonymous (a claim I cannot personally verify).
I personally wish Jami was more popular as I am sure its development would also increase and improve if they became more popular.
With threats to encryption from many European countries (lobbying for and demanding backdoors in encryption) and many other countries with their own ideas its something we will have to constantly monitor and be vigilant if we are to protect our right to privacy.
Some people say that internet privacy is an illusion but the pursuit to privacy is something we should continue to aspire to and not tear down or abandon under falsehoods.
Silliness such as online ID cards or providing sensitive information such as one’s physical ID card or submitting to facial recognition is not something I feel we should allow and its reasons like this article is one of many reasons why we shouldn’t allow it.
Discord has an odd identity. I believe it started as a gaming chat service from my recollections at the time when I was gaming which explains why it still has some gaming overtones to it but they have tried to diversify the experience somewhat but not so much as to alienate their user base completely.
People should stop using bloated and crappy online services like this one.
Well, at this point, I’d say IRC is more secure than this Discord rubbish.
Typical government action, try to solve one problem and create another one. Who except government did not see the obvious attraction for hackers to gain access to personal information?
Any large data base of personal data is a target and why Discord did not takes steps to protect it better is another question.
@JohnIL
Absolutely correct, however I would argue that there is no level of protection that could ensure your safety although your question is perfectly valid.
The more people that have crucial information on you the larger the surface of attack.
What makes services more attractive to criminals is two things the ease of entry but ultimately the bigger the reward and when you have so much sensitive data available to you then most definitely worth it.
Risk and reward. You wouldn’t visit a physical bank if it didn’t keep any money on the premises and perform a stick up/robbery on it would you?
The more people that will demand access to this sensitive information the higher the likelihood of you being caught up in a hack or falling victim to such things and the worst thing is that you were not being recklessly foolish with your sensitive information, no you were doing what was demanded of you and what is now expected. It’s funny because back in the day sharing such information was seen as dangerous and now we are expected to not only do it but to trust these idiots.
Who is to say that none of these companies or an employee will some day go rogue and sell your data. Data theft internally does and will happen.
These sorts of attacks are going to become more prevalent and perhaps much more lucrative for hackers in the very near future given the more direct and accurate kinds of data the hackers can pull from such garbage services.
Australia has signed itself up to be exposed to such things like the UK also as they continuously overlooked the security ramifications of such a scheme.
Privacy laws (not to mention consumer laws) are weak in Australia as they are often used as a testing ground for other countries to apply draconian laws.
Kudos to Australia for their token win over google though even though it will achieve very little to nothing. I expect they will fold like a cheap lawn chair as soon as google starts apply pressure or advocating for their garbage to continue through various avenues bypassing the rulings but that is another topic for sideloading and such.
Back on topic.
Who uses discord anyway?
I’d rather use the old bulletin boards or web forums than discord and use some other product for messaging such as SimpleX or some sort of Matrix based app/software than discord.
Heck I would rather use IRC than discord.
I don’t get it either – presumably because it’s free. Australian company Canva bought UK company Serif about a year ago and have just moved from a decent forum they had for Affinity products to Discord. Makes no sense.
Canva did that to possibly tamp down on the lack of action on bugs and issues with the Affinity software. Has anyone ever tried to solve a real problem with Discord, a site where teenagers go who aren’t allowed into MySpace? Heh.
Even Serif’s own bug forum doesn’t allow users to see the bug reports of others, so there’s no chance of learning if an Affinity user is having the same problem as others.