2.1M Discord users’ ‘deleted’ ID photos may be exposed in massive leak

Discord is reportedly being extorted by hackers responsible for breaching a database containing the sensitive age verification data of more than 2.1 million users, who are threatening to leak it.

In a Wednesday X post, malware repository VX-Underground claimed Discord is being extorted by the individuals responsible for compromising their Zendesk instance, which contains user data. The data includes 2,185,151 photos used for the age verification of 2.1 million users, including pictures of driver’s licenses and passports.

“Discord users drivers license and/or passport might be leaked, “ VX-Underground said.

The breach occurred on Sept. 20, when Discord’s Zendesk instance containing the data was compromised. On Friday, the gaming-oriented messaging platform disclosed the incident, claiming that “this incident impacted a limited number of users.”

Source: VX-Underground

Related: Age verification has made a colossal misstep, and blockchain needs to get involved

“A small number of ID images”

“The unauthorized party also gained access to a small number of government‑ID images (e.g., driver’s license, passport) from users who had appealed an age determination,” Discord claimed, promising to warn affected users via email.

Some users have raised an issue with the data being stored, as Discord promised that age verification data was “deleted directly after your age group is confirmed.” Still, the data source is not the age verification system but the photos sent to the helpdesk when appealing a ruling made by the automated age verification system.

Discord age verification screen. Source: Discord

Related: Compliance isn’t supposed to cost you your privacy

The dangers of age verification

Many cybersecurity and privacy advocates strongly oppose the imposition of document checks for online service age verification. The reason is that when large quantities of sensitive data are stored on a server, it becomes an attractive target for malicious actors, as in this case.

Some in the crypto and cryptography world are claiming that there are safer alternatives. In late August, layer-1 proof-of-stake blockchain Concordium launched a mobile application that allows users to verify their age without disclosing their identity.

The application relies on zero-knowledge proofs (ZK-proofs) to mathematically verify that users have provided proof of their age, without disclosing the full details. This would prevent the accumulation of large numbers of photos of documents on a server that can be breached at a later time.

Systems that use ZK-proofs do not have to rely on cryptocurrencies. Google Wallet, the search giant’s payment and digital card management application, said in late April that it had integrated ZK-proofs for age verification.

Magazine: Beyond crypto: Zero-knowledge proofs show potential from voting to finance