Discord partner’s manual age verification data breach includes selfies

The breach of thousands of Discord users’ data appears to be worse than initially reported, as details of the age verification data lost to hackers are reported.

Zendesk is identified as Discord’s third-party customer support service provider by TheGamer.

The data is understood to have been breached from the company performing manual age verification for users appealing the facial age estimation decision provided by k-ID. Photos of government IDs were known to be among the stolen data. Now social media posts suggest facial photos and up to 2 million ID documents were included, and the hackers have claimed to have data from 5.5 million users, according to Bleeping Computer.

Storing ID documents and facial photos is not a regulatory requirement for any age assurance law enacted around the world, and thus a clear case of over-retention.

But Zendesk denies involvement and says it was not hacked. Discord pushed back on the reported size of the breach, and stated it is working with law enforcement and external security experts.

“Of the accounts impacted globally, we have identified approximately 70,000 users that may have had government-ID photos exposed, which our vendor used to review age-related appeals,” Discord told TheGamer in a statement.

Xbox users in the UK who want to use the system’s social features, like the text and voice communications features it has in common with Discord, will have to perform age verification soon, it appears.

Microsoft originally announced in July that age verification was coming to comply with the Online Safety Act, and Pure Xbox reports that the latest Xbox Update Preview includes prompts for adult users in the UK to verify their ages.

The Tech Giant offers age assurance through biometric facial age estimation, which it has been working on for more than a decade.  Users also have the option to submit a government-issued ID document or carry out mobile provider or credit card checks, and Microsoft says all data is encrypted.

Hopefully Discord’s partner caught the last note.

Article Topics

age verification  |  data protection  |  Discord  |  facial age estimation (FAE)  |  Microsoft  |  Online Safety Act  |  UK age verification