Class Action Claims Discord Failed to Prevent Data Breach that Exposed Private User Information

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit claims that Discord failed to adequately protect the personal information of those who used the popular online communications platform’s third-party customer support services during a September 2025 data breach.

Want to stay in the loop on class action lawsuits that matter to you? Sign up for ClassAction.org’s free weekly newsletter.

According to the 31-page Discord data breach lawsuit, the company, whose platform is reportedly used by more than 200 million people each month, was hit around September 20 by a cyberattack that impacted its customer service provider. Per the suit, an unauthorized third party gained access to and exfiltrated the following personal information of Discord users who had contacted its customer service provider:

• Names;
• Discord usernames;
• Emails and any other contact details that were provided to Discord customer support;
• Images of government IDs, including driver’s licenses and passports;
• IP addresses;
• Messages with Discord customer service agents;
• Purchase histories associated with the at-issue Discord accounts; and
• Limited billing information, such as payment type and the last four digits of credit card numbers.

Related Reading: Discord Data Breach Investigation: IDs, Payment Card Info Exposed

The lawsuit alleges that the data breach occurred as a result of Discord’s negligence and failure to implement adequate cybersecurity protocols and procedures to protect the personally identifiable information (PII) of both current and former users in its possession.

Further, the complaint claims that Discord’s alleged lack of cybersecurity procedures amounts to a violation of the Federal Trade Commission (FTC) Act, which outlines required and suggested data security practices for businesses.

“Discord failed to properly implement basic data security practices. Discord’s failure to employ reasonable and appropriate measures to protect against unauthorized access to its customers’ PII constitutes an unfair act of practice prohibited by Section 5 of the FTC Act,” the lawsuit says.

Per the filing, Discord sent a notice of the data breach on October 3, 2025, 13 days after the incident occurred, to users whose personal data was potentially compromised. However, the class action lawsuit claims that this notice was not sent in a timely manner and lacked adequate information on how the data breach happened, what cybersecurity measures Discord had since implemented to guard against future attacks, or any information regarding where online the hacked information might now be found.

The Discord class action lawsuit seeks to represent anyone in the United States whose private information was compromised in the September 20, 2025 data breach.

Want to learn how to start a class action lawsuit? We’ve got you covered.