jahOct 5, 2025
Zack Whittaker

My latest: Discord said late on Friday that hackers stole users' government-issued IDs (passports and driver's licenses) from one of its customer support databases.

I wrote a few words about the risks of age verification laws, and why collecting people's government IDs is bad for security and privacy.

https://this.weekinsecurity.com/discord-says-users-government-ids-used-for-age-checks-stolen-by-hackers/

Discord says users' government IDs used for age checks stolen by hackers

Thanks to age verification laws, expect more data breaches of users' government-issued passports and driver's licenses.

~this week in security~
Oct 4, 2025 at 2:04pmWeb
Show threadZack WhittakerOct 4, 2025

For more on the Discord data breach, and all of the other cyber news you need to know from the week (plus news you might've missed), my cybersecurity newsletter has you covered.

Out Sundays. No email link/click tracking!

Sign up/RSS today! https://this.weekinsecurity.com/

~this week in security~

a weekly cybersecurity newsletter by Zack Whittaker, plus articles and more.

~this week in security~
Show threadF4GRX SébastienOct 4, 2025
@zackwhittaker ”it's just for verification purposes, we dont keep it”
Show threadFuxle 🔜EF30Oct 4, 2025
@f4grx @zackwhittaker somehow their delete scheduler doesn't work properly
Show threadLoxbert AsherOct 4, 2025
@f4grx @zackwhittaker can people sue them fr? Like they really said, that they won't collect data, but actually did it? Is it possible?
Show thread⁂ Fish Id WardrobeOct 4, 2025
@f4grx @zackwhittaker well, well. isn't this the argument Signal make too, for your phone number?
Show threadF4GRX SébastienOct 4, 2025
@fishidwardrobe @zackwhittaker @signalapp keeps your phone number as account identifier. This is known. Almost nothing else is kept.
Show threadFarshid Hakimy / فرشیدOct 4, 2025

@f4grx @fishidwardrobe @zackwhittaker @signalapp
Signal keeps the following data:
# Account
Phone number: (phone number)
Allow sealed sender from anyone: true
Find account by phone number: true
Badges: None

# Devices
- ID: 1
Created: 2025-08-31T21:29:44Z
Last seen: 2025-10-04T00:00:00Z
User-agent: OWA

Show threadF4GRX SébastienOct 4, 2025
@farshidhakimy @fishidwardrobe @zackwhittaker @signalapp yes. Thats not much.
Show threadBrokarOct 4, 2025

@f4grx

Yes, we do. And so much more ...

@zackwhittaker

Show threadfcalvaOct 4, 2025
@f4grx @zackwhittaker I mean they didn't say how much were affected. I don't like to give them the benefit of the doubt, but it could "only" be a day or two.
Show threadF4GRX SébastienOct 8, 2025

@fcalva @zackwhittaker 1.5 terabytes

https://insider-gaming.com/discord-hackers-claim-to-have-1-5tb-of-age-verification-photos/

Discord Hackers Claim To Have 1.5TB Of Age Verification Photos

According to a new report, the group that managed to hack Discord claim to have over 1.5TB of user data, including age-verification photos.

Insider Gaming
Show threadfcalvaOct 9, 2025
@f4grx @zackwhittaker Damn. Not sure if they had any sort of cleanup at that point x)
Show threadAnneHOct 4, 2025
@zackwhittaker Well said! "hapless politicians"😂😂
Show threadtroy_friz_zellOct 4, 2025

@zackwhittaker

I have never and will never give my ID to a website/app.

Hard no.

If your site requires it, I will simply go somewhere else. The Internet is vast.

Show threadJoseph Lorenzo Hall, PhDOct 4, 2025
@zackwhittaker I'm not familiar with discord but do they require age verification for access to NSFW channels/servers? That may mean everyone in those channels was exposed to this. I think they need to be much more forthcoming about the "small number" and if that implicates particular types of people
Show threadchuckadeus kummererOct 4, 2025
@zackwhittaker as long as everybody gets a few dozen ids of varying age/gender/location/credit score/etc I'm good ;)
Show threadicanttellyouOct 4, 2025
@zackwhittaker I'm 100% certain these government IDs were used to appeal false underage (under-13) bans. the breach is pretty sure related to their ZenDesk (help desk) portal, and not anything else.
Show threadZack WhittakerOct 4, 2025
@icanttellyou thank you! I added a link and a note to update.
Show threadwoe2youOct 4, 2025
@zackwhittaker This is why I verified by webcam. I'd rather they had a ten second clip of my face than ID that's just going to get stolen.
Show threadLukefromDCOct 4, 2025

@zackwhittaker This news will actually help shoot down new age verification laws.

I do not have a single account anywhere with age verification and I will keep it that way no matter what. I will always refuse to use any site that asks for ID, same as I refuse to complete any purchase in any store that asks for ID.

Show threadBrokarOct 4, 2025
@zackwhittaker Seen that on Steam. Smart guy.
Show threadWanWizard 🏴󠁧󠁢󠁳󠁣󠁴󠁿 🇳🇱Oct 4, 2025

@zackwhittaker The Belgian ID system I have worked on back in the day works with a government SAML service on top of an in-house, not outsourced authentication system.

No data is passed on to the requestor without the correct authorisations, and in case of an age check, an age is given in the request, and only a yes/no is returned.

The UK government excels in making botch jobs of each and every IT project, if only because they outsource everything, and those companies have different interests.

Show threadWanWizard 🏴󠁧󠁢󠁳󠁣󠁴󠁿 🇳🇱Oct 4, 2025
@zackwhittaker The Belgian (or at least the Flemish) government does outsource, but they keep all decision making in house, with their architects, specialists and programme managers in control and responsible for the projects, not the outsourcer.
Show threadluksfarrisOct 4, 2025
@wanwizard @zackwhittaker we have a similar thing in Italy, where a notification pops up from the government's app, and you have to scan your ID with the NFC reader
Show threadWanWizard 🏴󠁧󠁢󠁳󠁣󠁴󠁿 🇳🇱Oct 4, 2025

@luksfarris @zackwhittaker Exactly.

The government is responsible for its citizens ID information, which should never, ever, be outsourced, and access should be on a need to know and need to have basis,

In Belgium you use it to interact with all government services, from paying your taxes to identifying yourself with the council when you renew your driving license, or when you register after having moved house.

In the UK, security is a username and password, absolutely rediculous.

Show threadKnightmareOct 4, 2025
@zackwhittaker It was never about protecting the kids, it is about gathering data.
Show threadLuna chanOct 4, 2025
@zackwhittaker I knew this would happen.
Show threadVendettaOct 5, 2025
@zackwhittaker shocked pikachu face
Show threadScanOct 5, 2025

@zackwhittaker Not only that, but the hackers also probably got access to the pictures that Discord require with the user holding the id

So they full on got their face, government id and everything.

Show threadScanOct 5, 2025

@zackwhittaker Including usernames, so those users can now get harassed and doxxed.

Breaches on support platforms aren't uncommon, these companies need to secure their support stuff.

Show threadScanOct 5, 2025

@zackwhittaker Completely Zendesk's fault too probably.

Airbnb, Uber, Squarespace, Spotify, Vimeo, OpenTable, Shopify, Slack, and Zoosk, The Internet Archive, Discord and many more have suffered breaches due to Zendesk

Show threadMatthew WaltonOct 5, 2025
@zackwhittaker they KEPT them???
Show threadSandro  Oct 6, 2025
@zackwhittaker Oh no, if only someone could have predicted that