Detailed breakdown of the compromised data: usernames, Discord IDs, email addresses, billing addresses, and salted and hashed passwords.
On August 14th, the popular Telegram channel, Information Leaks, revealed an advertisement discovered on the dark web. In this ad, a threat actor claimed they possessed a database containing information from 760,000 Discord.io users. The compromised data included email addresses and hashed passwords for security.
Discord.io operates as a third-party platform that empowers users to create custom links for their Discord channels.
On August 15th, Discord.io confirmed a significant data breach and announced a complete suspension of all its activities in the foreseeable future. This involved shutting down all services and operations.
The company explained, “Our ongoing investigation into the breach shows that a vulnerability in our website’s code enabled unauthorized access to our database. Subsequently, the attacker successfully extracted the entire database and put it up for sale on an external platform.”
Exposed information includes usernames, Discord IDs, email addresses, billing addresses, and salted and hashed passwords. The compromised passwords “pertain only to a limited number of individuals who used non-Discord logins prior to our exclusive adoption of Discord as a login method in 2018.” While the passwords were kept secure, Discord.io strongly urges users to swiftly update them, especially if they lack uniqueness. The company made it clear that it does not retain any payment details.
“We will persist in investigating the potential causes of the breach and will take steps to prevent any future occurrences. This involves completely overhauling our website’s code and thoroughly enhancing our security protocols,” the company declared.
Discord.io has canceled active subscriptions, and users who recently purchased premium memberships will be fully reimbursed.
Story credit
