Discord message-scraping service claims access to 1.8 billion messages

Discord-focused online tool makers claim they have access to billions of user messages and a trove of voice sessions, files, and user profiles. The allegedly leaked data was scraped from the platform.

Attackers posted an ad for the service on a popular data leak forum, used to exchange stolen user data. The post claims that the service allows users to sift through billions of Discord records, which could be used to harass the platform's users.

We’ve reached out to Discord for comment and will update this article once we receive a reply.

Meanwhile, the data-scraping service claims that, for a fee, it allows users to peer into:

• 1.8 billion Discord messages
• 35 million users
• 207 million voice sessions
• 6,000 Discord servers

The Cybernews research team claims that while attackers could conceivably have access to data scraped from public and possibly private Discord servers, it’s impossible to know without subscribing to the service controlled by cybercriminals. The attackers claim that they’re updating the indexed Discord messages live, pointing to data in the services’ servers being up to date.

How are Discord messages exploited?

Attackers can find multiple ways to exploit leaked user messages. Without the obvious privacy concerns, malicious actors often use Discord activity to harass individuals and minorities.

In 2024, a shady website called Spy.Pet surfaced, claiming it had scraped billions of public Discord messages from nearly 620 million users.

Spy.Pet didn’t stop at message logs. It bundled users' Steam accounts and other linked platforms, offering what it called an “enterprise option” to anyone looking to train AI models on its data. That includes, allegedly, federal agencies.

“This is a tool that makes researching people for the sake of harassment or online arguments easier. It could be useful for people with certain intentions, but the same can be done without the service – it would just take much more manual labour,”

researchers explained.

“The service’s premise is similar to Spy.Pet, another data-scraping service, which Discord shut down last year. The new one allegedly has more integration with breached databases and FiveM servers. The service is likely created to facilitate online harassment,” the team explained.

FiveM is a custom client for multiplayer of the vastly popular video game Grand Theft Auto V (GTA5). The client enables users to create modified servers, including new features, changing car models, maps, and other features. The Discord data scraping service claims to have scraped usernames as well as other records from these custom servers.

In early 2024, Discord banned Spy Pet-linked accounts from its platform, essentially cutting data-scraping bots off the platform's servers. At the time, Discord reportedly said that scraping its services violated the company’s regulations.

According to the Cybernews researchers, the recently advertised service attempts to capitalize on at least two streams: people who will pay to read others’ messages, and individuals who will pay to have their data omitted from the service.

For example, the service’s ToS stipulates that users can pay a one-time fee to have all of their data permanently deleted from the service’s servers. Another option suggests Discord users pay a larger fee for them to be excluded from the data-scraping process altogether.

Who’s behind the Discord data scraper?

The recently advertised service’s terms and conditions (ToC) page claims that it is operated in Estonia, an EU member state, which means it is subject to one of the strictest privacy laws in the world.

Interestingly, the ToS indicates that data likely scraped from Discord is stored on servers located in the Russian Federation. The service's creators likely believe that by storing data outside the EU, in a country with which the EU doesn't have an entirely friendly relationship, they can avoid legal repercussions.

However, as the Spy.Pet case highlighted, services like this violate several articles of the GDPR, including the “right to be forgotten” in Article 17.

“This is a tool that makes researching people for the sake of harassment or online arguments easier. It could be useful for people with certain intentions, but the same can be done without the service – it would just take much more manual labor,” the team explained.

Due​​ to its large user base and tight-knit communities, Discord is often targeted by attackers. For example, earlier this year, one group claimed they managed to scrape over 348 million messages from nearly 1,000 public Discord servers.

What is data scraping?

Data scraping is a technique in which automated computer programs extract information from digital sources. Most often, automated bots are tasked with carrying the task, as it allows collecting vast amounts of data. Bots pretend to be web browsers to bypass scraper-blocking efforts.

Malicious actors often utilize the technique to collect personal information, which can later be used for identity theft, credential stuffing, or harassment. While the data scrapers gather is often public, having user details in one database enables them to automate targeted attacks. Scamming one user out of a million could be a net profit for the attacker.

Major social media platforms are often targeted as they have a large user base. Earlier this year, attackers claimed they had abused Facebook’s application programming interfaces (APIs) to scrape information on 1.2 billion of the Meta-owned platform’s users.

In 2024, malicious actors said they scraped the details of 500 million users from another Meta platform, Instagram.

FAQ