Discord blamed a vendor for its data breach — now the vendor says it was ‘not hacked’

5CA is simply a lawsuit work enactment institution that works with Discord. Recently, the chat level said the vendor had been breached arsenic portion of a “security incident” wherever 70,000 authorities ID photos whitethorn person leaked. Now, 5CA says in a station connected its website that it was “not hacked.”

According to Discord, “this incidental impacted a constricted fig of users who had communicated with our Customer Support oregon Trust & Safety teams,” and “of the accounts impacted globally, we person identified astir 70,000 users that whitethorn person had government-ID photos exposed, which our vendor utilized to reappraisal age-related appeals.” The institution said that (emphasis Discord’s) “this was not a breach of Discord, but alternatively a breach of a 3rd enactment work provider, 5CA, that we utilized to enactment our lawsuit work efforts.”

However, connected its website, 5CA shared its ain statement, which I americium including successful afloat beneath (with accent 5CA’s):

We are alert of media reports naming 5CA arsenic the origin of a information breach involving 1 of our clients. Contrary to these reports, we tin corroborate that nary of 5CA’s systems were involved, and 5CA has not handled immoderate government-issued IDs for this client. All our platforms and systems stay secure, and lawsuit information continues to beryllium protected nether strict information extortion and information controls.

We are conducting an ongoing forensic probe into the substance and collaborating intimately with our client, arsenic good arsenic outer advisors, including cybersecurity experts and ethical hackers. Based connected interim findings, we tin corroborate that the incidental occurred outside of our systems and that 5CA was not hacked. There is nary grounds of immoderate interaction connected different 5CA clients, systems, oregon data. Access controls, encryption, and monitoring systems are afloat operational and, arsenic a precautionary measure, are nether heightened review.

Our preliminary accusation suggests the incidental whitethorn person resulted from human error, the grade of which is inactive nether investigation. We stay successful adjacent interaction with each applicable parties and volition stock verified findings erstwhile confirmed.

We’ve asked 5CA to corroborate if it handled authorities ID photos and if it could stock much accusation astir the “human error” that whitethorn person been involved. We’ve besides asked Discord if it tin corroborate which institution was successful possession of the photos of authorities IDs that whitethorn person been accessed.