Discord—the free communications platform that combines voice, video, and text chat—has disclosed on Wednesday that about 70,000 users may have had sensitive data exposed to hackers following a breach of one of its third-party customer service vendors.
Discord says the breach originated from a vendor named 5CA and was linked to its support/age‐verification workflow. Discord has revoked that vendor’s access, begun notifying impacted users, and is cooperating with law enforcement and data protection authorities.
The affected data includes users' government ID photos submitted during the age-verification appeals. Other potentially exposed information includes names, usernames, email addresses, IP addresses, messages with support, and the last four digits of credit cards.
Crucially, full credit card numbers, passwords, and core Discord systems were not compromised, according to Discord. However, the hackers said that they stole 1.5 terabytes worth of data from Discord. This amount of stolen data claim is what a news site called 404 Media said may be larger than 70,000 user data Discord has reported so far.
The Age Verification Law in the U.S.
Age verification laws are rules passed by state governments that require websites, app stores, or online platforms to check that users are over a certain age before giving access to certain kinds of content. Platforms often require methods like:
- Asking for government-issued ID or matching a photo ID.
- Using public or private transactional data (records that confirm age).
- Facial recognition or scanning, or digital ID systems in some states.
The age verification law has been enacted in about half of U.S. states as of mid-2025 especially for adult content websites/platforms. For example, Texas passed HB 1181, which requires sites with a certain amount of “sexual content harmful to minors” (more than one-third of content) to verify users are 18 or older.
In fact, Pornhub—which is one of the most popular adult content platforms—is affected by the law in many states. To adhere to the age verification law, the platform has blocked traffic from states that have enacted the law altogether to avoid enforcing age checks.
This law was upheld by the U.S. Supreme Court in a 6-3 decision in June 2025. In addition to that, States like Ohio also passed laws (e.g. with House Bill 96) that require age verification via ID, scanning through databases, or even facial recognition.
Meanwhile, it's important to note that United States is not the only western country enacting age verification law. Even the United Kingdom (UK) has its own in place—called U.K.’s Online Safety Act. The U.K.’s Online Safety Act went into effect in July 2025, and requires online platforms—including Google, X formerly Twitter, YouTube, Spotify, and Reddit—to verify users’ ages.
Discord Breach Exposes the Dark Side of Age Checks
Although, the age verification laws were introduced to protect minors from harmful or explicit online content and to ensure that platforms comply with local and federal safety regulations. But, it also pose risks—especially the risks associated with third-party service platforms use to store data gathered from their users.
Verifying a user’s age helps prevent children from accessing pornography, violent media, or other age-restricted material. But in theory, the age check is to make the internet a safer space for everyone. Companies are holding accountable for who uses their services and what kind of content is accessible to younger audiences.
However, the Discord data breach shows how this well-intentioned effort can backfire. When platforms require users to upload government IDs or selfies to prove their age, they create large databases of sensitive personal information, and these kind of data are prime target for hackers.
Thousands of users who went through the “age-related appeal” process on Discord had their private information exposed, including ID photos.
The hack highlights how even a safety-driven policy can lead to serious privacy risks if data isn’t properly protected or if third-party systems are compromised—which is one of the risks associated with third-party vendors handling sensitive user data.
The breach of Discord users’ data illustrates the concerns that Digital Rights Advocates have expressed over the use of age checks as a means of making the internet “safer.” The Discord breach reinforces their argument: in trying to make the internet safer, we may be creating new vulnerabilities that put users’ identities and trust at greater risk.
