how it happened
- whoextortion groupper Discord, via its vendor
- the gapoutsourced support desk5CA, named by Discord
- thensupport ticketsincluding ID photos from age appeals
- the resultabout 70,000 ID photosper Discord; attackers claim far more
what everyone assumed
Outsourcing customer support is ordinary. A specialist company answers tickets around the clock, in more languages and at lower cost, and its agents only work inside the ticketing system. They cannot touch the product, the code or the servers. The sensitive part of the business stays in-house, and support handles conversations.
what happened
On 3 October 2025 Discord said an unauthorised party had compromised one of its third-party customer service providers. In an update on 9 October it put the number of users whose government ID photos may have been exposed at about 70,000. Those images had been sent to support by users appealing an age decision. Discord said the exposed data could also include names, usernames, email addresses, IP addresses, limited billing details and messages with support agents, and that it had revoked the vendor’s access to its ticketing system. It named the vendor as 5CA.
5CA disputed that account. In a statement on 14 October 2025 it said its own systems had not been hacked, that the incident came from the human error of one customer service consultant who obtained information used to get into a client’s ticketing system, and that the employee had been suspended. 5CA said it did not handle ID documents for Discord. The two companies’ versions do not match, and neither has published how the attackers got in.
The attackers made claims of their own to BleepingComputer: access to a support agent’s account at an outsourcing company, about 58 hours inside Discord’s Zendesk instance, data on 5.5 million users and around 2.1 million ID photos, a figure they later walked back. Discord called the numbers incorrect and part of an attempt to extort a payment. None of these claims has been confirmed.
step by step
- users who dispute an age check send a photo of their ID to supportThe tickets are handled by an outside customer service company.
- 20 September 2025the support vendor's access is used by attackersDiscord's date, as reported by BleepingComputer; the way in has not been disclosed.the assumption breaks here
- 3 October 2025Discord announces the incidentIt cuts the vendor off from its ticketing system and refuses to pay a ransom.
- 9 October 2025about 70,000 ID photos may be exposedDiscord names the vendor; 5CA says it was not hacked and blames one employee's error.
how it surfaced
Discord said the attacker’s aim was to extort a ransom from the company. Discord announced the incident publicly and refused to pay. It brought in a forensic firm, informed law enforcement and data protection authorities, and emailed affected users. A class action naming Discord and 5CA was filed in a US federal court on 7 October 2025.
A support desk holds everything customers have ever attached to a ticket.
The ticketing system was never treated as a store of identity documents, so it was never protected like one. It became one, a ticket at a time.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersOne login of one support agent at that outside team is taken over, or sold.what it costs youEverything any customer ever attached is now in someone else's hands, and the letters to customers have your name on them.
- or it goes like thisit happenedTwitter, 2020howCallers posing as IT get staff to sign in on a fake page, then use the internal account tool.what leavescontrol of customers' accountswho ends up with itattackers running a scam in your name
- or it goes like thisit happenedCoinbase, 2025howSupport agents are paid to photograph what their screen already shows.what leavescustomer identity documents and balanceswho ends up with itfraudsters who call your customers
sources
- Discord: Update on a security incident involving third-party customer service (9 October 2025)
- 5CA: Holding statement regarding security incident (14 October 2025)
- BleepingComputer: Discord discloses data breach after hackers steal support tickets (4 October 2025)
- BleepingComputer: Hackers claim Discord breach exposed data of 5.5 million users (8 October 2025)
- TechCrunch: Discord suffers data breach impacting at least 70,000 users (9 October 2025)
- PacerMonitor: Uceta v. Discord, Inc., N.D. Cal. 3:25-cv-08582
your turn
what you can do about it
this week
Search your support tickets for attachments that should not live there.
Ask whoever runs your help desk tool to search old tickets for ID scans, passports, bank details and contracts. Decide how long attachments are kept and who outside your company can open them. Discord's exposure came from appeals that users had sent to support, years of them, sitting in a tool an outside team could reach.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →