Discord says third-party breach affected 70,000 users' photo IDs.

Summary

By the CyberWire staff

Discord says third-party breach affected 70,000 users' photo IDs.

Discord has provided additional details on a third-party breach involving a vendor used for age verification. The company says the incident affected "approximately 70,000 users that may have had government-ID photos exposed, which our vendor used to review age-related appeals." The breach also involved personal and account details, limited billing information, and messages with customer service agents. Discord disputed claims that the breach exposed more than two million photo IDs, saying the extortionists have exaggerated the scope of the incident.

A Discord spokesperson told the BBC that the company will not pay a ransom, stating, "We will not reward those responsible for their illegal actions."

Russian hacktivist group targets critical infrastructure.

BleepingComputer reports that the Russia-aligned hacktivist group "TwoNet" has shifted from launching DDoS attacks to targeting critical infrastructure. Researchers at Forescout say the threat actor breached a honeypot system designed to mimic a water treatment plant. The attackers gained access to the human-machine interface (HMI) via default administrative credentials, then created a user account to establish persistence. The hackers then disabled PLCs, logs, and alarms. Forescout notes, "The attacker did not attempt privilege escalation or exploitation of the underlying host, focusing exclusively on the web application layer of the HMI."

Notably, the group believed it was inside a real water treatment facility, and claimed responsibility for the attack on its Telegram channel.

Chaos ransomware gets an upgrade.

Fortinet has published an analysis of the Chaos ransomware, which resurfaced with a new C++ variant earlier this year. Previous versions were written in .NET. Fortinet notes, "Beyond encryption and ransom demands, it adds destructive extortion tactics and clipboard hijacking for cryptocurrency theft." Additionally, the new version "adopts a destructive strategy by deleting the contents of very large files rather than encrypting them," which speeds up attacks but may make victims less likely to pay the ransom. The researchers note that this shift "implies that future Chaos variants may function more like a wiper than traditional ransomware."

Notes.

Today's issue includes events affecting , and Russia the United States.

Attacks, Threats, and Vulnerabilities

Cache smuggling: When a picture isn’t a thousand words (Expel) We recently observed an innovative campaign using the ClickFix attack tactic for cache smuggling. Here's what you need to know.

Research and Development

Elastic Security Labs Global Threat Report 2025 (Elastic) The adversary’s playbook has fundamentally changed. The era of slow, methodical intrusion has been replaced by a new model of high-velocity attacks that prioritize speed and efficiency. Attackers are now exploiting the trusted tools and workflows of the modern enterprise — cloud accounts, developer platforms, and browsers — making their actions harder than ever to distinguish from normal activity.

2025 State of the API Report | Postman (Postman) APIs are no longer just powering applications. They're powering agents. This year, our survey of over 5,700 developers, architects, and executives across the globe reveals that API strategy is fast becoming AI strategy.

Black Kite's 2025 Manufacturing Report Reveals Manufacturers Remain the #1 Ransomware Target for the Fourth Consecutive Year (Cision PR Newswire) /PRNewswire/ -- Black Kite, the leader in third-party cyber risk intelligence, today announced the release of its 2025 Manufacturing Report: Why Your Supply...

Legislation, Policy, and Regulation

California enacts law giving consumers ability to universally opt out of data sharing (The Record) The California Consumer Privacy Act, signed in 2018, gave Californians the right to send opt-out signals, but major browsers have not had to make opt-outs simple to use.

Homeland Security’s reassignment of CISA staff leaves US networks exposed (CSO Online) As the DHS moves some CISA staff to immigration and border roles, experts warn of slower threat detection, delayed advisories, and rising risks for both federal and enterprise systems.

Litigation, Investigation, and Law Enforcement

ICO’s £7.5m Clearview AI Fine a Step Closer After Legal Victory (Infosecurity Magazine) The ICO has won an Upper Tribunal appeal against Clearview AI over its intention to fine the company

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Don’t miss Jen Easterly, former CISA Director, headlining HIP Conf 25 (Charleston, SC, USA, Oct 7 - 9, 2025) Jen Easterly, former CISA Director, keynotes HIP Conf 2025. A globally recognized cybersecurity leader, Easterly brings unmatched insight into hybrid identity security and resilience. Register now for this must-attend event.

Uniting Women in Cyber 2025 (Crystal City, Virginia, USA, Oct 9, 2025) UWIC is the premier event for cybersecurity leaders, professionals, and aspiring practitioners. Connect with a vibrant community focused on emerging global trends, technological advancements, and workforce development. Attend UWIC 2025 to learn, share ideas, and expand your professional network!

AFRL Space Cyber Summit (Albuquerque, New Mexico, USA, Oct 15 - 16, 2025) The AFRL Space Cyber Summit is an annual event hosted by the Air Force Research Laboratory (AFRL) to bring together experts from government, academia, and industry to advance space cyber expertise and technologies, foster community-wide collaboration, and anticipate future technology growth in a cyber-contested space domain. The summit aims to develop cyber-secure systems for space, protect against evolving threats, and identify opportunities for collaboration and innovation.

ISC2 Security Congress 2025 (Nashville + Virtual, Tennessee, USA, Oct 29 - 31, 2025) Join thousands of cybersecurity experts at ISC2 Security Congress 2025 and help lead the future of our connected world. Gain the insights you need to stay ahead of the evolving digital landscape. From innovative software to new security strategies, ISC2 Security Congress 2025 is designed to ensure you can navigate tomorrow’s threats.

Cyber Innovation Day 2025 | Datatribe (Washington, DC, USA, Nov 4, 2025) If you’re raising a seed or pre-seed round and are building the next category-defining company, we want to hear from you! The DataTribe Challenge is the headline event of the afternoon at Cyber Innovation Day 2025, where five finalists take the stage after weeks of hands-on coaching from seasoned startup operators and investors. These five finalists—along with additional promising startups—will exhibit in the Cyber Innovation Expo Hall, gaining high-impact exposure to top investors, cybersecurity leaders, and strategic partners.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 10.09.25

Top stories.

Discord says third-party breach affected 70,000 users' photo IDs.

Russian hacktivist group targets critical infrastructure.

Chaos ransomware gets an upgrade.

Notes.

Attacks, Threats, and Vulnerabilities

Research and Development

Legislation, Policy, and Regulation

Litigation, Investigation, and Law Enforcement

Events