[HerrWinston]

Hello you all, just yesterday the youtuber No Text To Speech has uploaded a new Video, saying the hacker of the discord breach has spoken to him via discord.
The hacker was able to provide rock solid prove that he infact is the person behind this, he explained how the hack happened and what the future will show.

1. What actually happened?
A Employee of the third party customer service most likely got bribed to give access
After getting access, the hacker had 58 hours to export as much data as possible
There was no rate limit on requests on User Data AT ALL, meaning once he had the access, nothing stopped him
According to the hacker he made 60 MILLION requests.


2. What Data has been stolen?
- Phone numbers - around 50.000 people leaked
- Gov ID`s - approximately 70.000 people, very vague and probably a lie told by discord Spoiler (Click to View)

- Internal Documents of Discord themselves, for whatever reason they make tickets for this shit every employee has access too
- Addresses
- E-Mail addresses
- Credit Card information
- Billing information - According to the hacker 365 million USD valid transactions
- User Information like passwords aswell
- 1.8 million Items are in the file

3. Discord Lied
- Discord said there have been no Phone numbers breached, somewhat right but through the use of the API they still got the whole phone number.
- Discord said there have been no real addresses breached, lie the hacker literally showed pictures of breached addresses
- Discord said that the Hacker wants money so maybe the hacker wont leak the data but we do now know discord never intended to pay a dollar, they willingly put millions of childs at risk because they dont want to pay that shit
- "After receiving the Gov ID we will instantly delete all pictures" - A message you get when you need to verify your age, but now we know this didnt work out really well
Above brings me to the second point, "small amount of gov ID`s have been leaked" ??? 70000 users, most of them underage got leaked by this, by no means is this number small?
I could go on and on but you see where this is leading


4. Security Flaws
1. Third Party Employees, paying them nearly nothing - easily bribable
2. Every Supporter has access to all Tickets
3. No Rate Limit on Sending requests
4. Never deleting Gov ID`s or information in general
5. Poorly written API - see phone numbers
6. Lying on exposed Information
7. Slow reaction time on Attack - 56 hours 0 detection
8. this shit has happened before
.....


5. Future
-The Hacker stated he only wanted money, which he will not receive so he is planning on either just fully leaking the data or selling it
- Pedos will live in heaven, finding new people to target by the minute once this is leaked, watch out and better just get a new account.


- Hacker asked for 5mil$, discord refused, hacker asked for 3.5mil$, got ghosted, reaching out to NTTS is a last attempt of getting discord to reach a private agreement
- Hacker stated to delete all data once an agreement has been found, saying "this is just about money", claiming he means no harm to the children
- Hopefully Discord finally sees their insane security flaws and does something

5. Summary
I encourage to watch the video, as NTTS does explain this very well and goes more in depth then this TLDR, I wish you all the best and hope this thread was educational and that you all stay safe out there, I encourage to check the Support Ticket numbers you`ve been given by discord to look up possible breached data.

The Youtube Video:

[Bastille]

Nice summary, thanks for the thread, this story is crazy

In France we can't access porn websites anymore unless we prove we are old enough with an ID card validation, I've always refused, because of such things : "We do not store any information / data", my ass yeah

I've never been fond of Discord by the way

[HerrWinston]

Nice summary, thanks for the thread, this story is crazy

In France we can't access porn websites anymore unless we prove we are old enough with an ID card validation, I've always refused, because of such things : "We do not store any information / data", my ass yeah

I've never been fond of Discord by the way

Thanks for the kind words, yes its honestly insane to look at, for the the worst part by far is the fact of how many minors are attacked by this and that the Hacker says "he care about the children" but still wouldnt mind leaking them all for nothing if discord doesnt pay, scary what humans can become when driven by greed.

[onlineuser | D3RFER]

The guy behind it seems like a script kiddie, to be completely honest.
Discord having no limit on requests is absurd.

[Bastille]

Thanks for the kind words, yes its honestly insane to look at, for the the worst part by far is the fact of how many minors are attacked by this and that the Hacker says "he care about the children" but still wouldnt mind leaking them all for nothing if discord doesnt pay, scary what humans can become when driven by greed.

There are some hackers with "ethic" that don't target / expose / harm child, or attack hospitals (especially with ransomware for example), but some don't care at all. Most of hackers nowadays are into this field because of money, they have no principles.

[onlineuser | D3RFER]

There are some hackers with "ethic" that don't target / expose / harm child, or attack hospitals (especially with ransomware for example), but some don't care at all. Most of hackers nowadays are into this field because of money, they have no principles.

Yeah, but calling this guy a hacker, would be giving him too much credit.

[HerrWinston]

Yeah, but calling this guy a hacker, would be giving him too much credit.

In my mind not really, he played his cards right, calling him skid would be a wrong doing aswell, he executed it perfectly, its more like a social engineering hacker, executing his steps perfectly, making a telegram channel for everyone to see the data he is leaking, coorperating with a youtuber to get more attention, knowing who to bribe and how, succesfully extracting 60 million requests unnoticed (discords fault tho ), he clearly knew what he was doing

[onlineuser | D3RFER]

In my mind not really, he played his cards right, calling him skid would be a wrong doing aswell, he executed it perfectly, its more like a social engineering hacker, executing his steps perfectly, making a telegram channel for everyone to see the data he is leaking, coorperating with a youtuber to get more attention, knowing who to bribe and how, succesfully extracting 60 million requests unnoticed (discords fault tho ), he clearly knew what he was doing

Bribing someone for access is not considered social engineering at all

This is ( to me ) nothing but an ordinary dude, that found the right guy to bribe.
Also downloading the data unnoticed is super easy, when they are completely careless at discord.
But that’s just my opinion, if we all agreed, the world would truly be a boring place!

Nice article anyways.

[HerrWinston]

Bribing someone for access is not considered social engineering at all

This is ( to me ) nothing but an ordinary dude, that found the right guy to bribe.
Also downloading the data unnoticed is super easy, when they are completely careless at discord.
But that’s just my opinion, if we all agreed, the world would truly be a boring place!

Nice article anyways.

Very true, but the bribing aspect isnt what i really meant, its more the way of applying pressure on Discord, trying to blame discord for getting hacked, its truly interesting to see, the hate did shift more to discord through this, but your right, real hacking skills havent been applied here, although the definition of hacking, or beeing a hacker has been fulfilled here ^^
Thanks for the kind words

[onlineuser | D3RFER]

Very true, but the bribing aspect isnt what i really meant, its more the way of applying pressure on Discord, trying to blame discord for getting hacked, its truly interesting to see, the hate did shift more to discord through this, but your right, real hacking skills havent been applied here, although the definition of hacking, or beeing a hacker has been fulfilled here ^^
Thanks for the kind words

Sure interesting to see!
But it’s not social engineering.

Companies always risk someone could be bribed. The real issue on hand, is the lack of security within their system.

Also I’m not sure why he wouldn’t leak a bit of it, when his demands isn’t met. If he really want to apply pressure, he could do easily.

Either way - wp to the dude, if they actually end up paying him. However, I wouldn’t be surprised that they didn’t

[HerrWinston]

Sure interesting to see!
But it’s not social engineering.

Companies always risk someone could be bribed. The real issue on hand, is the lack of security within their system.

Also I’m not sure why he wouldn’t leak a bit of it, when his demands isn’t met. If he really want to apply pressure, he could do easily.

Either way - wp to the dude, if they actually end up paying him. However, I wouldn’t be surprised that they didn’t

I can assure you he is NOT getting payed by discord, there are 100 reasons to not pay, he pointed out that if they pay everything will be deleted further getting pressure from users.
The "hacker" has a telegram channel where he leaks some info from time to time, he is playing this very well

[johndoeman805]

hypothetically, what websites would one find the leaked data?

[HerrWinston]

hypothetically, what websites would one find the leaked data?

As far as I know, currently none as they havent been published, dont take my word for that tho. Also you might wanna check the Telegram if its still online, the hacker posts most information in there

[hkub]

As far as I know, currently none as they havent been published, dont take my word for that tho. Also you might wanna check the Telegram if its still online, the hacker posts most information in there

Very interesting write up! Has there been any new information about this? Whether he bribed an employee or SE'd them into getting access, he still pulled it off and to that I tip my hat to the man. I do not believe he will get paid by discord because they have no proof that he will delete the data and not ask for more money

[kingkashrox]

Found this very interesting tbh. It is a great thread.