The cybersecurity community has long lived by a simple principle: Don't collect more data than you can protect. But ID laws and other legal mandates now force many organizations to store massive amounts of sensitive data, putting them in the precarious situation of dealing with information they don’t necessarily want but have to safeguard. The recent data breach involving Discord illustrates this challenge. In early October 2025, the messaging and gaming platform disclosed that cyberattackers had compromised one of its third-party customer service providers, accessing personal information from users who had contacted Discord's Customer Support or Trust and Safety teams. While the breach included typical support ticket data, including names, email addresses, IP addresses, limited billing information and customer service messages, one category of stolen data stood out: government-issued identification documents. According to Discord's official statement, the cyberattacker gained access to government ID images from users who used Discord’s partner to appeal expulsions for being underaged. Discord didn't collect these government IDs on a whim. Age verification laws are proliferating worldwide. These laws typically mandate age verification through government-issued documents, such as driver's licenses, passports or national ID cards. Failure to verify IDs can result in millions of dollars in fines. The intention is sensible: protecting minors from inappropriate online content. Bu...
ID verification laws are fueling the next wave of breaches
Affected Software
Frequently Asked Questions
What is the main topic of this article?
The article discusses how new ID verification laws are leading to increased data breaches by forcing organizations to store large amounts of sensitive personal information.
What security implications are discussed?
The article highlights the security risks that arise from storing excessive sensitive data, making organizations vulnerable to cyber attacks.
What products or software are affected?
The Discord messaging and gaming platform is mentioned as an example of software affected by these ID verification laws.
What is the principal concern for organizations regarding ID laws?
Organizations are concerned about their ability to protect the vast amounts of sensitive information mandated by ID verification laws.
How do ID verification laws affect data security practices?
ID verification laws compel organizations to change their data security practices by increasing the volume of sensitive data they must collect and store, which may exceed their security capabilities.