Up to date: Added additional data from Akihirah in regards to the sale of the database.
The Discord.io customized invite service has quickly shut down after struggling a data breach exposing the data of 760,000 members.
Discord.io shouldn’t be an official Discord website however a third-party service permitting server house owners to create customized invitations to their channels. Many of the neighborhood was constructed across the service’s Discord server, with over 14,000 members.
Yesterday, an individual generally known as ‘Akhirah’ started providing the Discord.io database on the market on the brand new Breached hacking boards. As proof of the theft, the risk actor shared 4 person information from the database.
For these unfamiliar with the brand new Breached, it’s the rebirth of a preferred cybercrime discussion board identified for the sale and leaking of information stolen in data breaches.
Supply: BleepingComputer
In line with the risk actor, the database comprises the data for 760,000 Discord.io customers and consists of the next varieties of data:
"userid","icon","icon_stored","userdiscrim","auth","auth_id","admin","moderator","electronic mail","title","username","password","tokens","tokens_free","faucet_timer","faucet_streak","deal with","date","api","favorites","advertisements","lively","banned","public","area","media","splash_opt","splash","auth_key","last_payment","expiration"
Essentially the most delicate data within the breach is a member’s username, electronic mail deal with, billing deal with (small variety of folks), salted and hashed password (small variety of folks), and Discord ID.
“This data shouldn’t be personal and might be obtained by anybody sharing a server with you. Its inclusion within the breach does, nevertheless, imply that different folks would possibly be capable of hyperlink your Discord account to a given electronic mail deal with,” Discord.io defined in regards to the leaking of Discord IDs.
As first reported by StackDiary, Discord.io has confirmed the authenticity of the breach in a discover to its Discord server and web site and has begun quickly shutting down its companies in response.
“Discord.io has suffered a data breach. We’re stopping all operations for the foreseeable future,” reads a message on the service’s Discord server.
“For extra data, please confer with our #breah-notification channel. We’ll be updating our web site quickly with a duplicate of this message.”
The web site for Discord.io comprises a timeline explaining that they first realized of the data breach after seeing the submit on the hacking discussion board.
Quickly after, they confirmed the authenticity of the leaked information and commenced shutting down its companies and canceling all paid memberships.
Discord.io says they haven’t been contacted by the person behind the breach and haven’t shared any data on how they have been breached.
BleepingComputer spoke to the vendor of the Discord.io database, Akhirah, who confirmed that that they had not spoken to the Discord.io operators.
“It isn’t nearly cash”
The Discord.io website acts as a listing the place guests can seek for Discord servers matching particular content material and procure an invitation to entry it. In some circumstances, it’s required to buy and spend the positioning’s digital foreign money, Discord.io Cash, to achieve entry to an invitation.
When creating these Discord server profiles, the Discord.io phrases of use say that each one content material is the member’s sole duty however that the operators have the correct to take away any content material that’s unlawful or breaks their guidelines.
From the restricted archived pages of the positioning, BleepingComputer has seen Discord servers within the listing for all kinds of pursuits, together with anime, gaming, grownup content material, and extra.
Nevertheless, when BleepingComputer requested Akhirah in regards to the sale of the database, they mentioned it was not solely about earning profits however about how Discord.io allegedly hyperlinks to unlawful and dangerous content material.
“It isn’t nearly cash, a few of the servers they overlook I speaking about pedophilia and related issues, they need to blacklist them and never enable them,” Akhirah informed BleepingComputer.
The hacker informed BleepingComputer that there was a variety of curiosity within the database however principally from individuals who wish to use it for “doxing different folks they’ve issues with.”
As a substitute, Akhirah says they would favor to attend for the Discord.io operators to contact them about eradicating allegedly offensive materials from the positioning in alternate for not promoting or leaking the stolen database.
What ought to Discord.io members do?
Whereas the hacker says they haven’t offered the database, all members ought to deal with the scenario as if their information will probably be abused.
The passwords on this breach are hashed utilizing bcrypt, making them hardware-intensive and gradual to crack.
Nevertheless, electronic mail addresses might be helpful to different risk actors as they could possibly be used for focused phishing assaults to steal extra delicate data.
Due to this fact, if you’re a member of Discord.io, you have to be looking out for uncommon emails with hyperlinks to pages asking you to enter your password or different data.
For any updates in regards to the breach, you need to test the most important web site, which ought to include any details about potential password resets or emails from the service.
Replace 8/14/23: Added data from Akhirah.
