Reported to the TX Attorney General on December 5, 2025.
TX residents may qualify for compensation. Free attorney review — no obligation, no upfront cost.
Check My Rights →Discord Inc. was the subject of a data breach notification filed with the TX Attorney General. The AG filing was recorded on December 5, 2025. The breach or discovery date reported in the filing is September 20, 2025.
Discord Inc. operates as a leading digital communications and technology platform, providing voice, video, and text chat services used by hundreds of millions of individuals globally. Because the platform serves massive communities, enterprise clients, and individual users who interact daily, Discord maintains vast repositories of sensitive user data. This includes exhaustive communication logs, private direct messages, account credentials, authentication tokens, financial transaction histories for Nitro subscriptions, billing details, and verified identity information. The sheer volume and intimate nature of the data entrusted to Discord make its digital infrastructure an attractive and high-value target for sophisticated cybercriminals and malicious threat actors. In 2025, Discord Inc. formally reported a significant security incident to the Texas Attorney General, triggering legal scrutiny and mandatory notification procedures under state consumer protection statutes. Incidents impacting major technology platforms of this magnitude typically involve sophisticated cyberattacks such as unauthorized access to cloud-hosted databases, third-party vendor compromises, credential stuffing operations, or targeted exploitation of zero-day vulnerabilities within internal software pipelines. In the realm of digital communications and tech platforms, a breach of this nature often means that threat actors bypassed perimeter security controls to infiltrate systems housing sensitive user credentials and personally identifiable information, remaining undetected long enough to exfiltrate proprietary and private data. The exposure resulting from the 2025 security incident places affected users at severe and compounding risk. The compromise of full names, email addresses, mailing addresses, hashed passwords, encrypted authentication tokens, and payment card details opens the door to immediate digital harm. When credential hashes and email addresses are leaked, malicious actors frequently launch credential-stuffing attacks across other platforms, leading to widespread account takeovers, reputational damage, and financial fraud through unauthorized purchases or subscription exploitation. Furthermore, exposed personal communication logs and billing details provide cybercriminals with the exact social engineering ammunition needed to execute highly targeted phishing schemes, identity theft, and financial scams. As a technology company operating within the United States, Discord Inc. is legally bound by federal standards enforced by the Federal Trade Commission (FTC) under Section 5 of the FTC Act, alongside strict state privacy and data security mandates, including the Texas Identity Theft Enforcement and Protection Act. These legal frameworks require companies to implement robust, reasonable administrative, technical, and physical safeguards to protect user data from unauthorized access, exfiltration, and misuse. The occurrence of a widespread data breach strongly indicates a potential failure or breakdown in these mandatory security protocols, suggesting that vulnerabilities in system architecture, access controls, or vendor management were left unmitigated. Receiving an official data breach notification letter from Discord Inc. serves as formal legal acknowledgment that your personal information was compromised due to corporate security negligence. Under Texas law and federal precedent, this notification establishes the foundational legal standing required to participate in a class action lawsuit aimed at holding the company accountable. Importantly, affected individuals do not need to prove that they have already suffered direct financial loss to seek legal recourse; the increased risk of identity theft and compromised digital security is legally actionable. Our firm handles these data breach cases on a strict contingency fee basis, meaning you pay absolutely nothing out of pocket, and we only collect a fee if we successfully recover compensation on your behalf.
Under the Texas Identity Theft Enforcement and Protection Act, you may have a legal claim against Discord Inc. if any of the following apply:
Applicable law: This breach was reported under the Texas Identity Theft Enforcement and Protection Act, which establishes your right to seek damages from Discord Inc..
The hours spent responding to a data breach — canceling accounts, contacting credit bureaus, updating passwords, and investigating fraud — represent compensable economic harm in data breach litigation.
When login credentials are exposed, the costs of downstream account compromises — password managers, security audits, and recovery costs for hijacked downstream accounts — can be recovered. Courts in recent class actions have awarded damages for credential exposure even without proven misuse.
Several state data breach laws provide for statutory minimum damages — fixed amounts recoverable per affected individual regardless of actual loss. These provisions exist specifically to make legal action viable for victims who have not yet experienced direct harm.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
No. Under Texas Identity Theft Enforcement and Protection Act and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
Statutes of limitations for data breach claims vary by state but typically run 2–4 years. Depending on when you learned of the breach, you may still have time. Contact our office for a free eligibility review — there is no cost to find out.
Accepting free credit monitoring from Discord Inc. does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Not necessarily. Many data breach victims are never notified directly. If your personal information was held by Discord Inc. during the relevant period, you may still qualify even without receiving a letter. A free eligibility review can confirm your status.
Most data breach class actions resolve within 18 to 36 months, though timelines vary by court and complexity. Your participation requires minimal effort — typically completing a claim form. Our office handles all litigation; you are notified when a settlement is reached.
Received a notification letter from Discord Inc.?
Read our dedicated guide — what the letter means and exactly what to do.
If you were affected by the Discord Inc. data breach, you may be entitled to compensation. Submit your information below for a free attorney review — no obligation, no upfront cost.
Source: State Attorney General filing, TX
View Official AG Filing →Discord Inc. breach?
Free case review · No fee unless you win