Discord Age Verification Policy Linked to Data Breach
Discord's new global age verification policy, which requires face scanning or government ID, has reportedly suffered a data breach affecting 70,000 users. The system, which uses AI to infer adult content without a manual override for server administrators, has been criticized for being easily bypassed. The incident highlights the privacy and security risks associated with mandatory identity verification and automated AI moderation.
- The October 2025 breach originated from a third-party customer service vendor named 5CA. Discord stated the attackers accessed 5CA's support ticket system, but 5CA has denied that its own systems were hacked or that it handled government-issued IDs for Discord. - In addition to the approximately 70,000 government ID photos, the data breach also exposed users' names, email addresses, IP addresses, and messages exchanged with Discord's support teams. The attacker reportedly tried to extort a ransom from the company following the data theft. - The global rollout of the age verification policy is driven by regulations like the UK's Online Safety Act. Discord is now using dedicated age verification partners, including k-ID for its global system and previously Persona for a small-scale test in the United Kingdom. - For the majority of users, the system does not require an ID or face scan; instead, it uses an internal machine learning "age inference model" that predicts a user's age based on behavioral patterns and account signals, not private message content. - The new verification system, provided by partner k-ID, was quickly bypassed by users. Methods include free, publicly available tools that use manipulatable 3D models to fool the facial scan and code scripts that can be pasted into a browser's developer console to bypass the check entirely. - Discord asserts that under the new system, video selfies are processed entirely on a user's device and never transmitted, while government IDs are used only to confirm age and are then
