On September 20, 2025, Discord suffered a data breach via its third-party vendor 5CA, which handled customer service and age verification appeals. The attack, attributed to groups like Scattered Spider, LAPSUS$, and ShinyHunters, lasted 58 hours and exposed sensitive data of ~70,000 users globally. Compromised information included government-issued IDs (passports, driver’s licenses), full names, emails, usernames, contact details, limited billing data (last four digits of cards, payment history), IP addresses, customer support messages, and internal training documents. While full credit card numbers, CVV codes, passwords, and private messages remained secure, hackers demanded a ransom (initially $5M, later reduced to $3.5M), which Discord refused to pay. The breach highlights risks tied to mandatory age verification laws, as the stolen IDs and personal data could enable identity theft or fraud. Discord terminated 5CA’s access, launched an investigation, and notified affected users, but the incident underscores vulnerabilities in third-party handling of sensitive user data.