Massive Data Breach on Discord.io Exposes Personal Information of 760,000 Members

In a significant cybersecurity incident, the data of nearly 760,000 members of Discord.io has been put up for sale on a darknet forum by a hacker using the alias “Akhirah.” The breach occurred on August 14, 2023, endangering the privacy of a vast number of customers.Discord.io and the BreachDiscord.io is a platform that allows users to create customized Discord invites. The breached database includes email addresses, hashed passwords, and other user-specific information.The hacker provided evidence of the breach by revealing four user records from the compromised database. Reports from StackDiary indicated that the database is currently being sold on the newly emerged Breach Forums, controlled by the infamous ShinyHunter hackers.Details of the Compromised DataThe hacker claims that the compromised database contains information from approximately 760,000 Discord.io members. The dataset includes a variety of user data, such as usernames, icons, authentication details, email addresses, names, passwords (salted and hashed for a limited number of users), tokens, and more.Among the most sensitive information exposed are a member’s username, email address, billing address (limited cases), salted and hashed password (limited cases), and Discord ID. Discord.io clarified that although this information isn’t entirely private, its inclusion in the breach could potentially link a user’s Discord account to a specific email address.Discord.io’s ResponseDiscord.io swiftly acknowledged the breach and temporarily suspended its services. The platform verified the authenticity of the compromised data and took immediate steps to mitigate the impact. Paid memberships were terminated, and the website’s services were temporarily shut down.The platform issued a message on its Discord server stating, “Discord.io has suffered a data breach. We are stopping all operations for the foreseeable future.” The company also directed users to its #breach-notification channel for more information and assured that updates would be provided on the website.Discord’s Clarification and User RecommendationsDiscord, the parent company, clarified that it is not affiliated with Discord.io and doesn’t share user information with it. The company emphasized its commitment to user data protection and encouraged users to enable Two-Factor Authentication (2FA) for enhanced security.In response to the breach, Discord revoked OAuth tokens for users who had interacted with Discord.io. This ensures that the app can no longer perform actions on behalf of these users until they re-authenticate.User Security MeasuresUsers who are members of Discord.io are advised to remain vigilant and cautious. They should be wary of suspicious emails containing links that require them to enter passwords or other sensitive information. Immediate actions recommended include changing passwords and implementing Two-Factor Authentication (2FA) on their accounts to bolster security.ConclusionThe breach of Discord.io’s database underscores the critical importance of cybersecurity vigilance and strong security measures. It also serves as a reminder for users to remain cautious about their online activities and to take proactive steps to safeguard their personal information. As the threat landscape continues to evolve, both platforms and users must stay proactive in implementing security measures to counter potential breaches and cyberattacks.