Connect with us

Technology

Discord confirms vendor breach exposed user IDs in ransom plot

Published

on

Discord confirms vendor breach exposed user IDs in ransom plot

NEWYou can now listen to Fox News articles!

In 2025, it feels like cybercriminals are winning while the world’s biggest data hoarders are losing. One by one, global giants are admitting they’ve been breached, from tech powerhouses like Google to insurance leaders such as Allianz and Farmers and even luxury brands like Dior. The latest company to report a breach is Discord. The popular chat platform confirmed that hackers gained access to a third-party customer support provider, 5CA, exposing user data including names, email addresses, limited billing details and even government ID images.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

MAJOR COMPANIES, INCLUDING GOOGLE AND DIOR, HIT BY MASSIVE SALESFORCE DATA BREACH

Hackers hit Discord’s support vendor, exposing sensitive user data worldwide. (Phil Barker/Future Publishing via Getty Images)

Advertisement

How the breach happened and what data was exposed

The company confirmed that the breach, which occurred on September 20, did not involve a direct attack on Discord’s servers. Instead, attackers gained unauthorized access to 5CA, one of Discord’s third-party customer service providers. This allowed them to view information from users who had reached out to Discord’s Customer Support or Trust & Safety teams.

Discord is a chat app primarily used by gamers, but it has expanded to various other communities, enabling text messages, voice chats and video calls. Some even use it as a replacement for Slack. The platform currently has a monthly user base of over 200 million. The data exposed included Discord usernames, real names, emails, limited billing details such as payment type and the last four digits of credit cards, IP addresses and messages exchanged with customer service agents. In some cases, government ID images provided for age verification were also compromised. Discord estimates that around 70,000 users globally may have had government ID photos exposed.

Reports suggest the attackers attempted to use this access to demand a ransom from Discord. Bleeping Computer reported that the Scattered Lapsus$ Hunters (SLH) threat group claimed responsibility for the attack earlier this month. This is the same group that claims to have access to over a billion Salesforce records and is demanding ransom for those as well.

JEEP AND CHRYSLER PARENT STELLANTIS CONFIRMS DATA BREACH

About 70,000 users had ID images stolen in the latest third-party data breach. (Tiffany Hagler-Geard/Bloomberg via Getty Images)

Advertisement

What Discord is doing now and what users should do next

Discord disclosed the incident 13 days later, on October 3. Since then, it has cut off the third-party support provider’s access, launched an internal investigation with a digital forensics team and started informing affected users. It also clarified that any communication about the breach will come only from noreply@discord.com and that it will never contact users by phone regarding this incident. The company added that some data remained safe: full credit card numbers, CCV codes, account passwords and activity outside of customer support conversations were not exposed.

Discord also stated that it has notified relevant data-protection authorities about the breach, is working closely with law enforcement and is auditing its third-party vendors to ensure they meet its enhanced security and privacy standards going forward.

A representative at Discord issued a statement, saying in part, “We want to address inaccurate claims by those responsible that are circulating online. First, as stated in our blog post, this was not a breach of Discord, but rather a third-party service we use to support our customer service efforts. Second, the numbers being shared are incorrect and part of an attempt to extort a payment from Discord. Of the accounts impacted globally, we have identified approximately 70,000 users that may have had government-ID photos exposed, which our vendor used to review age-related appeals. Third, we will not reward those responsible for their illegal actions. All affected users globally have been contacted, and we continue to work closely with law enforcement, data protection authorities and external security experts. We’ve secured the affected systems and ended work with the compromised vendor. We take our responsibility to protect your personal data seriously and understand the concern this may cause.”

Discord cuts ties with vendor 5CA and tightens its security investigations. (Kurt “CyberGuy” Knutsson)

6 steps you can take to stay safe after the Discord breach

If you think your details might have leaked in the Discord data breach, below are some steps you can take to stay protected.

Advertisement

1) Enable two-factor authentication

Two-factor authentication (2FA) adds an extra verification step when logging in, making it much harder for attackers to access your account even if they have your password. Discord supports 2FA via authenticator apps or SMS. Once enabled, you’ll receive a code each time you log in from a new device. This simple step can prevent account takeovers and gives you peace of mind.

2) Consider a personal data removal service

The less information available about you, the harder it is for attackers to target you. Review what personal details you’ve shared online, and remove unnecessary data from websites and apps. A personal data removal service can help scrub your information from data broker sites, making it more difficult for attackers to connect the dots and launch identity theft or phishing attacks.

While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

Advertisement

3) Use strong, unique passwords for all accounts

Reusing passwords across platforms makes it easy for attackers to access multiple accounts if one password is compromised. A password manager can generate long, complex passwords and store them securely, so you don’t have to remember them all. This not only protects your Discord account but also your email, banking and other online services.

Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords, and secure those accounts with new, unique credentials. 

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

4) Monitor accounts for suspicious activity

Even if you don’t see immediate signs of compromise, attackers can try to exploit stolen data later. Regularly check your email and Discord login history for unusual sign-ins. Services like identity theft protection can scan the dark web for your credentials and alert you immediately if they appear, helping you react quickly before serious damage occurs.

Identity Theft companies can monitor personal information like your Social Security Number (SSN), phone number and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals. 

Advertisement

See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

5) Be cautious with emails, messages or links, and use strong antivirus software

Phishing attacks often spike after breaches. Attackers may send messages that look like official notifications asking you to reset your password or provide personal information. Always verify the sender, avoid clicking unknown links, and never share sensitive info. Treat every unexpected message as suspicious, even if it appears to come from Discord or another trusted service.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com. 

6) Keep devices and software up to date

Attackers often exploit outdated software and known vulnerabilities. Ensure your operating system, apps and antivirus software are current.

Advertisement

 

Kurt’s key takeaway

If the recent breaches are any indication, third-party services that companies rely on are often the weakest link in cybersecurity. Discord’s steps to contain the situation are necessary, but they highlight a bigger problem. Many companies do not implement sufficient safeguards to protect sensitive user data. Weak oversight of third-party providers, delayed responses and inadequate security policies leave personal information exposed and vulnerable to attackers.

Should companies be held more accountable for breaches caused by third-party providers? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Advertisement

Copyright 2025 CyberGuy.com. All rights reserved.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Technology

Meta expands nuclear power ambitions to include Bill Gates’ startup

Published

on

Meta expands nuclear power ambitions to include Bill Gates’ startup

These AI projects include Prometheus, the first of several supercluster computing systems, which is expected to come online in New Albany, Ohio, sometime this year. Meta is funding the construction of new nuclear reactors as part of the agreements, the first of which may come online “as early as 2030.” These announcements are part of Meta’s ongoing goal to support its future AI operations with nuclear energy, having previously signed a deal with Constellation to revive an aging nuclear power plant last year.

Financial information for the agreements hasn’t been released, but Meta says that it will “pay the full costs for energy used by our data centers so consumers don’t bear these expenses.”

“Our agreements with Vistra, TerraPower, Oklo, and Constellation make Meta one of the most significant corporate purchasers of nuclear energy in American history,” Meta’s chief global affairs officer, Joel Kaplan, said in the announcement. “State-of-the-art data centers and AI infrastructure are essential to securing America’s position as a global leader in AI.”

Continue Reading

Technology

Why January is the best time to remove personal data online

Published

on

Why January is the best time to remove personal data online

NEWYou can now listen to Fox News articles!

January feels like a reset. A new calendar. New goals. New habits. While you clean out your inbox, organize paperwork or set resolutions, however, scammers also hit reset, and they start with your personal data.

That is because January is one of the most important months for online privacy. This is when data brokers refresh profiles and scammers rebuild their target lists.

As a result, the longer your information stays online, the more complete and valuable your profile becomes. To help address this, institutions like the U.S. Department of the Treasury have released advisories urging people to stay vigilant and avoid data-related scams. 

For that reason, taking action early in the year can significantly reduce scam attempts, lower identity theft risks, and limit unwanted exposure for the rest of the year.

Advertisement

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

January is when data brokers refresh profiles and scammers rebuild target lists, making early action critical for online privacy. (iStock)

STOP DATA BROKERS FROM SELLING YOUR INFORMATION ONLINE

Why personal data does not expire and keeps compounding online

Many people assume old information eventually becomes useless. Unfortunately, that’s not how data brokers work.

Data brokers don’t just store a snapshot of who you are today. They build living profiles that grow over time, pulling from:

Advertisement
  • Public records (property sales, court filings, voter registrations)
  • Retail purchases and loyalty programs
  • App usage and location data
  • Past addresses, phone numbers, and relatives
  • Marketing databases and online activity.

Each year adds another layer. A new address. A changed phone number. A family connection. A retirement milestone. On its own, one data point doesn’t mean much. But together, they create a detailed identity profile that scammers can use to convincingly impersonate you. That’s why waiting makes things worse, not better.

Why scammers ‘rebuild’ targets at the start of the year

Scammers don’t randomly target people. They work from lists. At the beginning of the year, those lists get refreshed.

Why January matters so much:

  • Data brokers update and resell profiles after year-end records close
  • New public filings from the previous year become searchable
  • Marketing databases reset campaigns and audience segments
  • Scam networks repackage data into “fresh” target lists.

Think of it like the upcoming spring cleaning, except it’s criminals organizing identities to exploit for the next 12 months.

If your data is still widely exposed in January, you’re far more likely to:

Once your profile is flagged as responsive or profitable, it often stays in circulation.

As personal information accumulates across databases, digital profiles grow more detailed and more valuable to scammers over time. (Kurt “CyberGuy” Knutsson)

Why taking action in January protects you all year long

Removing your data early isn’t just about stopping scams today; it’s about cutting off the supply chain that fuels them. When your information is removed from data broker databases:

  • It’s harder for scammers to find accurate contact details
  • Phishing messages become less convincing
  • Impersonation attempts fail more often
  • Your identity becomes less valuable to resell.

This has a compounding benefit in the opposite direction. The fewer lists you appear on in January, the fewer times your data gets reused, resold, and recycled throughout the year. That’s why I consistently recommend addressing data exposure before problems start, not after.

Why retirees and families feel the impact first

January is especially important for retirees and families because they’re more likely to become targets of fraud, scams, and other crimes.

Advertisement

Retirees often have:

  • Long addresses and employment histories
  • Stable credit profiles
  • Fewer active credit applications
  • Public retirement and property records

Families add another layer of risk:

  • Relatives are linked together in broker profiles
  • One exposed family member can expose others
  • Shared addresses and phone plans increase visibility

Scammers know this. That’s why households with established financial histories are prioritized early in the year.

Why quick fixes don’t work

Many people try to “start fresh” in January by:

Those steps help, but they don’t remove your data from broker databases. Credit monitoring services alert you after something goes wrong. Password changes don’t affect public profiles. And unsubscribing doesn’t stop data resale. If your personal information is still sitting in hundreds of databases, scammers can find you.

The January privacy reset that actually works

If you want fewer scam attempts for the rest of the year, the most effective step is removing your personal data at the source.

You can do this in one of two ways. You can submit removal requests yourself, or you can use a professional data removal service to handle the process for you.

Removing your data yourself

Manually removing your data means identifying dozens or even hundreds of data broker websites, finding their opt-out forms and submitting removal requests one by one. You also need to verify your identity, track responses and repeat the process whenever your information reappears.

Advertisement

This approach works, but it requires time, organization, and ongoing follow-up.

Using a data removal service

A data removal service handles this process on your behalf. These services typically:

  • Send legal data removal requests to large networks of data brokers
  • Monitor for reposted information and submit follow-up removals
  • Continue tracking your exposure throughout the year
  • Manage a process that most people cannot realistically maintain on their own

Removing your data at the start of the year helps reduce scam attempts, phishing messages and identity theft risks all year long. (iStock)

Because these services handle sensitive personal information, it is important to choose one that follows strict security standards and uses verified removal methods.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

RETIREES LOSE MILLIONS TO FAKE HOLIDAY CHARITIES AS SCAMMERS EXPLOIT SEASONAL GENEROSITY

Advertisement

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

Kurt’s key takeaways

Scammers don’t wait for mistakes. They wait for exposed data. January is when profiles are refreshed, lists are rebuilt, and targets are chosen for the year ahead. The longer your personal information stays online, the more complete-and dangerous-your digital profile becomes. The good news? You can stop the cycle. Removing your data now reduces scam attempts, protects your identity, and gives you a quieter, safer year ahead. If you’re going to make one privacy move this year, make it early-and make it count.

Have you ever been surprised by how much of your personal information was already online? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Advertisement

Sign up for my FREE CyberGuy Report 
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

Copyright 2025 CyberGuy.com. All rights reserved.

Advertisement
Continue Reading

Technology

Xbox’s Towerborne is switching from a free-to-play game to a paid one

Published

on

Xbox’s Towerborne is switching from a free-to-play game to a paid one

Towerborne, a side-scrolling action RPG published by Xbox Game Studios that has been available in early access, will officially launch on February 26th. But instead of launching as a free-to-play, always-on online game as originally planned, Towerborne is instead going to be a paid game that you can play offline.

“You will own the complete experience permanently, with offline play and online co-op,” Trisha Stouffer, CEO and president of Towerborne developer Stoic, says in an Xbox Wire blog post. “This change required deep structural rebuilding over the past year, transforming systems originally designed around constant connectivity. The result is a stronger, more accessible, and more player-friendly version of Towerborne — one we’re incredibly proud to bring to launch.”

“After listening to our community during Early Access and Game Preview, we learned players wanted a complete, polished experience without ongoing monetization mechanics,” according to an FAQ. “Moving to a premium model lets us deliver the full game upfront—no live-service grind, no pay-to-win systems—just the best version of Towerborne.”

With the popular live service games like Fortnite and Roblox getting harder to usurp, Towerborne’s switch to a premium, offline-playable experience could make it more enticing for players who don’t want to jump into another time-sucking forever game. It makes Towerborne more appealing to me, at least.

With the 1.0 release of the game, Towerborne will have a “complete” story, new bosses, and a “reworked” difficulty system. You’ll also be able to acquire all in-game cosmetics for free through gameplay, with “no more cosmetic purchasing.” Players who are already part of early access will still be able to play the game.

Advertisement

Towerborne will launch on February 26th on Xbox Series X / S, Xbox on PC, Game Pass, Steam, and PS5. The standard edition will cost $24.99, while the deluxe edition will cost $29.99.

Continue Reading

Trending