Discord users suffer the first high-profile age-verification hack – and it's unlikely to be the last

Discord has confirmed one of its third-party customer service providers suffered a security incident. As a result, the personal information of certain users was accessed – including government-issued IDs.

We have seen age verification laws launched around the world, including in the UK, US, and the EU. Many have been attempting to use the best VPNs as a way of avoiding age checks, citing their perceived cybersecurity risks.

Experts have warned collecting sensitive personal information, such as government-issued IDs, is a "disaster waiting to happen" and sites adopting age verification would be a prime target for hackers.

Discord's case seems to reinforce this point, as IDs used for age verification were accessed. IDs were not directly submitted to the third-party in question but were reportedly shared by users "who had appealed an age determination."

Discord data accessed

Discord confirmed "an unauthorized party" targeted its third-party customer support services "to access user data, with a view to extort a financial ransom from Discord."

The type of data accessed depended on what users shared with customer support, but Discord data may include:

• Name, Discord name, email address, and other contact details
• Limited billing information
• IP address
• Messages with customer service agents
• Limited corporate data
• Government ID images

Discord said affected users will receive an email from noreply@discord.com and if an image of your ID was accessed, you will be informed of that in the email.

Full credit card information, CCV codes, passwords, and messages or activity on Discord was confirmed to be safe.

Upon learning of the incident, Discord revoked the third-party's access to its ticketing system and launched an internal investigation.

The relevant authorities and law enforcement were notified, and Discord reviewed its threat detection systems and security controls for third-party support providers.

Discord recommended "impacted users stay alert when receiving messages or other communication that may seem suspicious."

How does this connect to age verification?

The unauthorized accessing of sensitive personal information, including IDs used for age verification, highlights the security risks these laws pose – and why many want to avoid them.

The IDs were not stolen from a dedicated age check provider, and there haven't yet been reports of these services suffering an attack. But this incident reaffirms the dangers of sharing your personal information with potentially unknown third-parties.

Critics argue that people shouldn't need to submit personal information to access certain websites. The laws are in place to protect children from harmful content online, which is something that should be commended. However, there are more secure and privacy-focused ways of safeguarding minors.

Laura Tyrylyte, privacy advocate at NordVPN, said "device-level controls are the most effective way to manage children's internet access," Parental control tools were given as an example as you can limit app downloads, impose age ratings, and block material.

Age verification laws were introduced nationwide in the UK via the Online Safety Act back in July 2025. VPN usage spiked considerably in the country as people looked to bypass age verification checks.

Since then, age verification has surged in the US and 24 US states now have active age verification laws – with more to come.

Ohio's age verification law came into effect on September 30, 2025, four days after laws came into effect in Arizona.

Search terms for VPNs have increased in these states and across America. Michigan lawmakers have proposed a total VPN ban to combat the viewing of harmful content, and Missouri is due to see age verification become law on November 30, 2025.

Follow Tom's Guide on Google News, or add us as a preferred source, to get our up-to-date news, analysis, and reviews in your feeds. Make sure to click the Follow button!