Discord Security Incident - Page 1
Forum section: electronics / general

author: Karel
author_rank: Super Contributor
timestamp: October 09, 2025, 09:25:36 am
content: "we have identified approximately 70,000 users that may have had government-ID photos exposed"https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service

author: PlainName
author_rank: Super Contributor
timestamp: October 09, 2025, 12:02:23 pm
content: Quote from that link:QuoteDiscord were the custodians of the data and responsible for it. They chose to hand it out to this third party and thereforedidsuffer a breach.

author: Bud
author_rank: Super Contributor
timestamp: October 09, 2025, 12:40:37 pm
content: These days you must provide a copy of a government issued ID to join a forum?

author: u666sa
author_rank: Frequent Contributor
timestamp: October 09, 2025, 01:16:47 pm
content: There are bots out there, mainly on Kali linux, which let you know who is who. Photo, all accounts, location, ID's etc...How they do it? They look up databases, which are leaked or hacked, or whatever. Hackers on darknet sell those databases. Eventually they end up in access of those bots.For examplehttps://t.me/HaveIBeenHacked_BotFeel free to plugin your phone number, email, password, or other information. You will find out a lot about yourself, even stuff you have forgotten long ago,.You'll be surprised how much information about you is floating out there. All that information you discover was leaked by someone, in other instances it was hacked by someone.Your e-mail address is a signature, it's a fingerprint, you using it across how many services? Many! It leads to your identity.Same with your user name. Your username leads to to you, since you are using same username across many many services.Even your passwords leads to you. Even if it hasn't been hacked, the hash of your password is unique.An avatar could lead to you and expose your identity if it's unique enough.Age, date of birth, circle of contacts and friends, the way you speak online, words you commonly type, just to name a few.In some cases whatever you typed 20 years ago in some forgotten forum is available, even though it was deleted long time ago.

author: Analog Kid
author_rank: Super Contributor
timestamp: October 09, 2025, 05:46:51 pm
content: Quote from: u666sa on October 09, 2025, 01:16:47 pmSo if you do that, what're the chances that the info you give will end up in some database somewhere?No thanks.

author: tom66
author_rank: Super Contributor
timestamp: October 09, 2025, 06:25:15 pm
content: This will be a major problem with the UK's Online Safety Act which require users to ID themselves for certain content, but with such a broad net that lots of other content is caught too. Use a VPN and bypass all ID checks by pretending to be in a free country again. It's crazy.

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 09, 2025, 06:36:04 pm
content: Quote from: Bud on October 09, 2025, 12:40:37 pmOh you'll soon have to provide your ID for pretty much anything.

author: SteveThackery
author_rank: Super Contributor
timestamp: October 09, 2025, 10:19:49 pm
content: Quote from: SiliconWizard on October 09, 2025, 06:36:04 pmBut you do anyway, don't you? Any kind of interaction with the government, your bank, your pharmacist, your streaming TV provider, your email client, every website that requires a username and password, the ATM you've just used.... the list is endless.Sometimes it's nothing more than giving the correct name and address to your pharmacist; most times it's entering your secret password or PIN; in the case of streaming TV you only enter your password once, but the principle is the same. Same with your email client. Increasingly you use Windows Hello or your preferred OS equivalent; and two-factor authentication is another method to the same ends. I have over 200 passwords in my password manager - each one is so I can convince someone or something that I really am me.Every one of these examples is you proving who you are, and I bet most of us do this a few times most days. Proving who you are is so normal, so routine, that we take it for granted, barely give it a thought.Whether you think this a good thing or not, the reality is that we are already there.

author: PlainName
author_rank: Super Contributor
timestamp: October 09, 2025, 10:37:07 pm
content: QuoteNo, they are examples of proving you are the one that knows the (anonymous) registration details for the account. Certainly few of them involve government ID; only banks and actual government accounts involve your actual real-life self.Although, given your account name here, you might not have realised the benefits of that yet.

author: Analog Kid
author_rank: Super Contributor
timestamp: October 09, 2025, 10:37:51 pm
content: There's always a chance you can refuse to give some information that's requested.Case in point: today I called an insurance place to get quotes on auto insurance. Of course I had to give a lot of information: name, address, stuff about my vehicle, etc.Then they asked me for my phone #. I asked them why they needed that; they couldn't give me a good answer (something about "in case we need to call you back").I declined to give them that information. "You don't need that."They didn't fight me on that; I still managed to get the quotes I wanted.So one of their forms they had to fill out has a blank spot. Big fucking deal. Not my problem.Try it sometime: it's salutary. The system needs to be given the middle finger from time to time.If people ever stop pushing back then we're really screwed.

author: TimFox
author_rank: Super Contributor
timestamp: October 09, 2025, 11:44:42 pm
content: Interesting call with the agent.Most companies and others I talk to note my number from caller ID, and use it to verify who I am.

author: Analog Kid
author_rank: Super Contributor
timestamp: October 10, 2025, 12:30:59 am
content: Quote from: TimFox on October 09, 2025, 11:44:42 pmWell, sure, assuming you're already a customer or client of theirs.I made a cold call to the agent, so they had no prior knowledge of who I was.I'm just trying to limit the unnecessary info that gets compiled on me.I've done this before and have had the person I was talking to respond with "Well, we really don't need that ...". Not often but sometimes.

author: PlainName
author_rank: Super Contributor
timestamp: October 10, 2025, 11:59:13 am
content: More on this from Reddit:https://old.reddit.com/r/LegalAdviceUK/comments/1o2bg5x/discord_reached_out_to_me_on_20th_september_2025/Precis: Discord told the user their verification ID would be deleted straight after verification, yet it seems to be part of the trove sucked up months later.I guess there is a possibility that the ID was deleted but the user is still notified because they are on record of providing ID. However, Discord seem to be pretty confident that they have identified the 70K users who have had their data stolen so one assumes this user has indeed had their supposedly erased data included.

author: golden_labels
author_rank: Super Contributor
timestamp: October 10, 2025, 01:22:02 pm
content: Quote from: tom66 on October 09, 2025, 06:25:15 pmPoland is now silently pushing a similar bill (UD 179). They already shrugged off a risk of such incidents occuring with claiming that… the law will make such leaks illegal. If that wasn’t insult on its own, mentioned fragment is merely a single, short sentence that says it’s illegal, period.

author: Karel
author_rank: Super Contributor
timestamp: October 15, 2025, 01:26:03 pm
content: We are aware of media reports naming 5CA as the cause of a data breach involving one of our clients(Discord).Contrary to these reports, we can confirm that none of 5CA’s systems were involved, and 5CA has nothandled any government-issued IDs for this client. All our platforms and systems remain secure,and client data continues to be protected under strict data protection and security controls.https://5ca.com/blog/holding-statement-security-incident/

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 15, 2025, 01:41:07 pm
content: Quote from: golden_labels on October 10, 2025, 01:22:02 pmIllegal, wow. That's blunt. I'm sure "hackers" are absolutely in panic now.

author: radiolistener
author_rank: Super Contributor
timestamp: October 15, 2025, 01:52:45 pm
content: Quote from: SiliconWizard on October 09, 2025, 06:36:04 pmThis situation could be mitigated once the underlying TLS issues are resolved. Currently, information like fingerprints and the server name in requests can be observed, which allows third parties to infer sensitive details. Fixing these vulnerabilities would prevent such exposure and reduce the need for intrusive identity verification.

author: Halcyon
author_rank: Unknown
timestamp: October 16, 2025, 04:53:51 am
content: This might be a controversial opinion, but I think the days of threatening to leak private information are numbered.Take me for example: I use a burner number for ordering things or making reservations for dinner, I use a PO Box for just about everything, and because of my previous employment, my address details are even suppressed on my driver's licence (even most police aren't able to look it up), yet, my personal information is already out there because I had solar panels installed at my house and my address was leaked in a data breach involving that company.Can you imagine "regular" people who don't take any precautions? At some point, just about everyone's private information will be available in one form or another, so how are more data breaches going to change anything?I think it has already begun with companies increasingly refusing to pay ransom demands, because the information stolen is no longer really that "private".

author: Sorama
author_rank: Frequent Contributor
timestamp: October 16, 2025, 05:19:04 am
content: Quote from: u666sa on October 09, 2025, 01:16:47 pmNow that would be pretty stupid to do.

author: golden_labels
author_rank: Super Contributor
timestamp: October 16, 2025, 07:42:06 am
content: Quote from: Halcyon on October 16, 2025, 04:53:51 amBut ransom demands also involve encrypting company’s data and making the thing public.Many companies have neither useful backups nor contingency plans. They face a pretty simple choice: pay the ransom and hope for the best, or face very turbulent time. If extortionists kept their promise, paying a ransom is just a rational choice. It’s also the least burdensome, as adversaries try to make payment as convenient to a coöperating target as possible. This mechanism isn’t going anywhere.There is a dent in the image: the promises are kept only in about a half of the cases. With that knowledge people may be more reluctant to act rational, not paying in the result. But this part is also within the control of adversaries. A matter of where this system reaches equilibrium between the three groups: targets, extortionists keeping promises, and dishonest leeches. The tug-o-war between the last two decides and I make any predictions about that.As for the latter part, public image tarnishing, it may seem as if it’s going to become irrelevant. But that is only if we think about people acquiring goods and services. There is another group: investors. To them the company must look solid, must give off image of robustness and strength. The mere suspicion of a company being a victim to an attack becomes an unacceptable defect.Regardless of all that, I don’t get how some data being leaked implies no new data can leak.