Gaming chat app Discord has suffered another user data breach, with a suspected 1 million email addresses stolen alongside (potentially many more) user IDs and IP addresses. While Discord was not targeted directly, third party security service Double Counter have reported a “deliberate, multi-stage attack” wherein hackers spent nearly six hours poking around their infrastructure before the vulnerability was closed.
Double Counter essentially acts as a bouncer bot for Discord servers, promising to detect and block unsanctioned alt accounts and prevent hostile ‘raids’ by large groups of malicious users. While its efficacy in that mission is debated by Discord users, and the service has previously been accused of selling user data for revenue, the fact is that Double Counter can collect and store personal info of the users that visit its ‘protected’ servers. Info that, now, has been partly or entirely nicked by Internet miscreants.
By Double Counter’s own estimates, around 1 million user email addresses have been affected, with databases of Discord IDs, usernames, IP addresses, and even location info for up to 28 million users also “partly” copied by the hackers. Security breach trackers Have I Been Pwned further report that 275,000 of the pinched emails and usernames have since been posted publicly.
Basically, it’s the worst Discord hack via a third-party service provider since the last Discord hack via a third-party service provider, which occurred almost a year to the day ago – spooky! – when cyberburglars compromised one of Discord’s customer service partners. Among the data haul was, reportedly, some 70,000 photos of users’ government-issued IDs.
I’ll leave it to security fuckup theorycrafters to determine which of these breaches is worse. Neither reflect particularly well on Discord itself, even with the defence that it wasn’t penetrated directly, and this latest hack comes amid a faltering rollout of an age verification system which – at least in the UK – has funnelled data into a company backed by Epstein penpal and antichrist-obsessed tech creep Peter Thiel.
I wonder if that Mumble server I had in 2011 is still going.
Update 08/10: RPS recieved the following statement from a Discord spokesperson: “We’re aware of a security incident involving Double Counter, a third-party app available on Discord. While this was not a breach of Discord, we’ve disabled new installs of the app while we work with Double Counter to understand the full scope of the incident, and we’ll take further action as appropriate.”
