# Discord support vendor breach exposes ~70,000 government ID photos · pwn.watch

> An attacker got into a third-party customer-service system Discord used, exposing data of users who had contacted Support or Trust & Safety. About 70,000 users may have had government ID photos (from age-verification appeals) accessed. Discord named the vendor as 5CA, which denied its systems were hacked.

Page: https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025 · generated 2026-10-23T00:16:28.879Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Discord customer support (third-party vendor / ticketing)
- Started: 2025-10-03 · closed: 2025-10-09
- Affected: n/a

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025/feed.xml
- JSON Feed: https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025.json
- This file: https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025/llms.txt

## Updates (newest first)
- 2025-10-09: Discord update: vendor named as 5CA; about 70,000 users may have had government-ID photos exposed (https://www.discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service)
- 2025-10-03: Discord discloses that a third-party customer service provider was compromised (https://www.discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service)

## Fix brief
# Security brief: Discord support vendor breach exposes ~70,000 government ID photos

Source: https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025 · status: closed (closed Oct 9, 2025) · severity: high · updated Oct 9, 2025

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
An attacker got into a third-party customer-service system Discord used, exposing data of users who had contacted Support or Trust & Safety. About 70,000 users may have had government ID photos (from age-verification appeals) accessed. Discord named the vendor as 5CA, which denied its systems were hacked.

Severity detail: Third-party breach exposing government ID images

- Product: Discord customer support (third-party vendor / ticketing)

## Affected versions
- n/a

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Latest updates
- Oct 9, 2025: Discord update: vendor named as 5CA; about 70,000 users may have had government-ID photos exposed
- Oct 3, 2025: Discord discloses that a third-party customer service provider was compromised

## Advisories
- [Update on a Security Incident Involving Third-Party Customer Service](https://www.discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service) (Discord)

## Write-ups & news
- [ID photos of 70,000 users may have been leaked, Discord says](https://www.bbc.com/news/articles/c8jmzd972leo)
- [Hackers claim Discord breach exposed data of 5.5 million users](https://www.bleepingcomputer.com/news/security/hackers-claim-discord-breach-exposed-data-of-55-million-users/)
- [Discord blamed a vendor for its data breach — now the vendor says it was 'not hacked'](https://www.theverge.com/news/799274/discord-security-breach-5ca-vendor-blamed-not-hacked)

## Caveats
Dates from Discord's statement (posted 2025-10-03, updated 2025-10-09). The 5.5M figure is the attackers' claim; 5CA disputes being hacked.

---
Machine-readable: https://pwn.watch/i/discord-support-vendor-breach-id-photos-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.