Discord.io custom invite service confirms data breach as hacker sells data of 760K users

A data breach has hit Discord.io, a third party service providing custom invites to Discord servers. The breach occurred on August 14, 2023, and exposed the personal data of over 760,000 users.

Discord.io, not related to the official Discord, has suspended services due to the breach. The Discord.io site acts as a directory where visitors can search for Discord servers matching specific content and obtain an invite to access it.

The hacker, 'Akhirah,' is selling the breached Discord.io database on the Breached hacking forums. The package they are selling includes:

• Discord usernames,
• IDs,
• emails,
• salted/hashed passwords

The full package as shared on the Breached forums contains the following columns:

"userid","icon","icon_stored","userdiscrim","auth","auth_id","admin","moderator","email","name","username","password","tokens","tokens_free","faucet_timer","faucet_streak","address","date","api","favorites","ads","active","banned","public","domain","media","splash_opt","splash","auth_key","last_payment","expiration"

Although passwords are hard to crack, the rest of the data  could be exploited for phishing and names for social engineering

Discord.io promptly confirmed the breach, suspending all operations indefinitely and providing breach details on their website. The hacker, Akhirah, wants malicious content removed from the site and seeks communication with the platform's management.

"It's not just about money, some of the servers they overlook I talking about pedophilia and similar things, they should blacklist them and not allow them," Akhirah told BleepingComputer.

Discord.io confirms they have been contacted by the attacker but have not disclosed any details of the attack.