Discord Data Breach Lawsuit Says Company Failed To Protect User Information

Case Overview: The lawsuit claims Discord failed to maintain reasonable data protections before a 2025 cyberattack that compromised user information.

Consumers Affected: Discord users whose personal data, including government ID and billing information, was exposed during the breach.

Court: U.S. District Court for the Northern District of California

Discord failed to protect user data that resulted in a September 2025 breach compromising sensitive personal information, including government ID images, credit card details, and user communications, a new lawsuit claims.

The lawsuit alleges that the communication platform failed to implement reasonable cybersecurity protections, leaving millions of users vulnerable to identity theft and fraud, and it failed to sufficiently manage the aftermath.

Plaintiff Alleges Personal Information Was Exposed After Cyberattack

Florida resident Jacqueline Uceta filed the lawsuit after receiving a data breach notice from Discord, informing her that her personal information had been exposed. She says she has already suffered harm, including the time and expense of monitoring financial accounts and the loss of privacy and peace of mind. 

The lawsuit notes that victims of data breaches often face years of risk, with stolen information, such as government IDs and credit card fragments, commonly sold on the dark web. The complaint also cites research showing that nearly one in three people affected by a breach later fall victim to identity fraud, underscoring the lasting impact of such incidents.

Complaint Points To Known Vulnerabilities And Delayed Notification

The lawsuit alleges that an unauthorized party accessed Discord’s third-party customer support system around September 20, 2025, stealing personal data stored there. However, users were not notified until early October, nearly two weeks later. The data reportedly included names, email addresses, IP addresses, billing details, and messages exchanged with Discord’s customer service team.

According to the complaint, Discord’s security failures allowed hackers to exploit known vulnerabilities. It accuses the company of maintaining outdated systems, lacking encryption protocols, and failing to follow Federal Trade Commission guidelines for protecting sensitive consumer data.

The lawsuit also points out that Discord experienced a smaller breach in 2023, suggesting the company was aware of its weaknesses but did not take sufficient steps to fix them.

The Federal Trade Commission has previously warned that inadequate data security can amount to an “unfair business practice” under federal law, which the lawsuit argues Discord violated by failing to act on well-established cybersecurity standards.

Other Companies Face Similar Data Security Lawsuits

Discord joins a growing list of companies accused of mishandling customer data. Lawsuits have recently been filed against Major League Baseball’s ticketing platform for alleged security lapses that left fan accounts exposed.

Allianz Life Insurance has been hit with multiple lawsuits after a breach affected 1.4 million policyholders, and Victoria’s Secret is also facing legal action after a May 2025 incident that allegedly exposed customer information.

Uceta seeks to represent all U.S. residents whose data was compromised in the Discord breach. The lawsuit accuses the company of negligence, unjust enrichment, and breach of implied contract. It seeks damages, lifetime credit monitoring, and a court order requiring Discord to adopt stronger data security measures to prevent future breaches.

Case Details

• Lawsuit: Uceta v. Discord, Inc.
• Case Number: 3:25-cv-08582
• Court: U.S. District Court for the Northern District of California 

Plaintiffs' Attorneys

• (Eddie) Jae K. Kim and Gerald D. Wells, III (Lynch Carpenter, LLP)

Have you ever had your data leaked in a security breach? Let us know in the comments.