9 ms·
Here's the October 2025 Discord data breach mentioned at the end of the article: https://www.bbc.com/news/articles/c8jmzd972leo https://www.bbc.com/news/articl
by accrual 8mo ago
Here's the October 2025 Discord data breach mentioned at the end of the article:
https://www.bbc.com/news/articles/c8jmzd972leo https://www.bbc.com/news/articles/c8jmzd972leo
> Discord, a messaging platform popular with gamers, says official ID photos of around 70,000 users have potentially been leaked after a cyber-attack.
However, their senior director states in this Verge article:
> The ID is immediately deleted. We do not keep any information around like your name, the city that you live in, if you used a birth certificate or something else, any of that information.
Why they didn't do that the first time?
- wolvoleo 8mo agoAnd do they really actually delete it this time?
- fruitworks 8mo agoI have it on good authority that they really truly delete it this time, super duper pinky promise
- ekianjo 8mo agoOnce it's out there the only assumption that holds is no trust, and therefore all bets are off.
- Hikikomori 8mo ago>Why they didn't do that the first time? The company they hired to do the support tickets archived them, including attachments, rather than deleting them.
- malfist 8mo agoAh, so it was the "staffer" excuse.
- hn_acc1 8mo agorogue engineer
- joquarky 8mo agoHow convenient.
- engineeringwoke 8mo agoAh sorry our contractor did all that highly illegal stuff. Too bad we can't pierce the corporate veil anymore... shucks.
- pavel_lishin 8mo ago> The ID is immediately deleted. We do not keep any information around like your name, the city that you live in, if you used a birth certificate or something else, any of that information. This is also contradicted by what Discord actually says: > Quick deletion: Identity documents submitted to our vendor partners are deleted quickly— in most cases, immediately after age confirmation. What are the non-most cases?
- rsynnott 8mo agoAlso, _Discord_ deleting them is really only half the battle; random vendors deleting them remains an issue.
- rockskon 8mo agoNot to mention collecting them at all means those servers are a primo location for state actors to stage themselves to make copies of data before being deleted. To say nothing of insider threats of which likely exist across every major social media platform in service to foreign govs.
- nativeit 8mo agoIt was this deep into the thread when I decided I don’t think I need internet service this bad, let alone Discord. I think I’m out. Let us know how it goes!
- roysting 8mo agoAll of these types of developments, of the trap door starting to close, really do totally depend on the addiction, the dependency that was created to make sure the people would be unable to withdraw themselves. We now have some generations of people who have only been online and in a fantasy world of games and “TV”. It seems the system has calculated that we have crossed the threshold after which the system is self-reinforcing and there is very little chance of effective resistance, let alone reversal.
- varispeed 8mo ago> The ID is immediately deleted. I call it bollocks. Likely they have to keep it for audit and other purposes.
- smaudet 8mo ago"delete" doesn't mean delete anymore, like you say, there are always audit logs, and there is "soft" deleting. Expect any claims that things are being deleted to be a bold faced lie.
- BikiniPrince 8mo agoWe deleted it from someplace. It's not our fault we have more places!
- subscribed 8mo agoThey wouldn't _have to_, audit checks if you stick to law, your own policies and such, but I think they will.
- varispeed 8mo agoSo how do they prove they actually checked someone's age?
- lII1lIlI11ll 8mo agoHow does shop clerk proves they checked someone's age before selling them alcohol?
- Gigachad 8mo agoThey don’t need to prove that. The government or whatever would have to prove that they aren’t checking ages, by going to the site and seeing a lack of age verification.
- observationist 8mo agoThey're a nonsense company, and trusting them with any information is foolish. They'll store everything and anything, because data is valuable, and won't delete anything unless legally compelled to and held accountable by third party independent verification. This is the default. The purpose of things is what they do. They're an adtech user data collection company, they're not a user information securing company.
- IhateAI_3 8mo ago[dead]
- debo_ 8mo agoI believe the original finding was that they were not deleting IDs that were involved in disputes.
- Aurornis 8mo agoThey explained it in their announcement at https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service https://discord.com/press-releases/update-on-security-incide... TL;DR: The IDs were used in age-related appeals. If someone's account was banned for being too young they have to submit an ID as part of the appeal. Appeals take time to process and review. Discord has 200,000,000 users and age verification happens a lot due to the number of young users and different countries.
- plorg 8mo agoWhy should we suspect the age verification and age-related appeals would involve different teams or processes?
- reactordev 8mo agoThis is corporate cover speak for “we keep all data”
- theshrike79 8mo agoYeaaah, nope. GDPR is no joke and storing people’s actual ID card photos is a gigantic liability. Companies treat that stuff like it’s toxic waste, they want to get rid of it as fast as possible and permanently.
- reactordev 8mo agoWe’re talking about Discord. The same people who put everyone’s “server” as a chat room on WebRTC. They don’t share your same sense of toxicity.
- _ink_ 8mo agoCompliance
- reactordev 8mo agoLiars…
- CGMthrowaway 8mo ago> The ID is immediately deleted. We do not keep any information around like your name, the city that you live in, if you used a birth certificate or something else, any of that information. Everyone says this, including the TSA. But they never say they don't keep a hash, or an eigenvector of your biometric. Which is equally as important.
- hinata08 8mo agoThey also never say it goes through datacenters in room 641A or though Utah before it's "deleted", because it's a US company and they can't refuse that.
- eks391 8mo agoIn case someone is unaware, 641A and Utah and both references to the US mass surveillance systems in this context. Specifically interceptors that a company wouldn't be able to prevent from saving your data for the few seconds they need to process and delete it
- miki123211 8mo agoI might be misremembering, but AFAIK, that kind of surveillance mostly worked because many companies didn't bother encrypting datacenter-to-datacenter traffic, thinking that those networks are trusted. That mistake has since been rectified though. With almost everything going over TLS these days and HTTPS being the norm, even for server-to-server APIs, it's much harder to snoop on traffic without the collaboration of one of the endpoints, and the more companies you ask for that kind of collaboration, the higher your risk of an unhappy employee becoming a whistleblower.
- hinata08 8mo agoThat's also about US companies that can't refuse or can't bother to challenge that a dragnet is set up in their process. ISPs themselves didn't save any data. However, they gave interception rooms to the NSA (which is indeed technically not them). Nowadays ISPs aren't the right scale to do it for the reasons you mentioned. But the USA lowkey moved the dragnet to the main datacenters with prism, then made it mandatory for all with the CLOUD act. And if the threat is not coming from the USA, but some other country starts to ask Discord to BCC them the IDs of their citizens, we can do the odds on whether Discord will challenge it or not. Now I want to ask Discord who is their third party provider ? Why don't they process IDs themselves ?
- bilekas 8mo agoUntil we have some kind of "One Time ID Verification" service that would work, the ID will never be deleted. Or a hash of the info or some kind of identifiable info.
- phatfish 8mo agoHumm yeah, like a government digital ID of some sort. Except people go mental about that, so sending scanned copies of my personal ID documents to every bank/solicitor/estate agent/mortgage broker/random internet service it is then...
- direwolf20 8mo agoOr if they don't need your ID.
- moffkalast 8mo agoSigh, I guess it's time to move platforms again or get your identity stolen. The more a company makes a fuss about trusting users, the more likely they store all of their shit in plaintext with vibe coded server security.
- einpoklum 8mo ago> We do not keep any information around like your name But they might be sending a copy to the NSA, similarly to how Alphabet, Yahoo, Apple, Meta etc. have been doing (PRISM program, part of the Snowden revelation [1]). The US has the legal mechanisms of requiring this to happen, secretly, such as NSLs [2]. [1] : https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM [2] : https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter
- matheusmoreira 8mo agoI bet the NSA does not even require their cooperation. They are probably already inside their systems.
- funkyfiddler369 8mo agoDeleted from some location or purged from their entire system? > We do not keep any information around ... "around"