76万名Discord用户的数据在暗网上公开出售

一个昵称为“Akhirah”的身份不明的人在暗网论坛“breachforums”上出售聊天应用Discord包含数十万用户账户的数据库以及Discord.io服务器（ Discord的第三方界面）的访问权限。

卖家发布帖子出售注册用户数据库和Discord服务器访问权限，其中包含76万条记录，包括电子邮件地址、散列密码和其他用户数据。

具体字段为：

"userid","icon","icon_stored","userdiscrim","auth","auth_id","admin","moderator","email","name","username","password","tokens","tokens_free","faucet_timer","faucet_streak","address","date","api","favorites","ads","active","banned","public","domain","media","splash_opt","splash","auth_key","last_payment","expiration"

为了证明自己的言论和意图，攻击者提供了一份经网络安全专家验证的数据样本：

"763743","496019580389687317","ea2d24619c4a52f857461c9369bfd74e","Zz3N8VHoM8st","noiraka#0","discord",NULL,"0","0","[email protected]",NULL,,"$2a$08$wJTAAhpn58jL5CiKh.huKuuS5NrItYaKhAKxyHLu7LAcKTt1Oj/d6","0","250","0000-00-00 00:00:00",NULL,NULL,"2023-08-14 02:26:28","Uqxl8Rhmxr3N",NULL,"1","1","0","1",NULL,"0","0",NULL,"$2a$08$VL7Ko7Bg8BOSRrzXz4Ajk.r0IBM9ps.ejcRpLxOMkr7/ymWYfXvb6",NULL,NULL,"0"
"763744","906737735648288818",,NULL,"sasuke un uchiwa#1385","discord",NULL,"0","0","[email protected]",NULL,,"$2a$08$xyMQ7K4Lr4sT4AbLC6/e/.quDaVOgb3h7F93yt5fcw57wTZBt2mri","0","250","0000-00-00 00:00:00",NULL,NULL,"2023-08-14 02:29:49","MHnq743FmXKT",NULL,"1","1","0","1",NULL,"0","0",NULL,"$2a$08$7tT8BL2l5qhx9J5QK/SAru6qz9Q7RP4hW4KCB81ptb9TOUPmVCnvi",NULL,NULL,"0"
"763745","954136358329397318","cc5c5f215f068e5d6231fb5ee314c3f9","D10kxMSasLA6","3boda_#0","discord",NULL,"0","0","[email protected]",NULL,,"$2a$08$lUJe86qVax6yuE93Ru8YN.HGb4GTNWazLhmMAD/F8Ytz3IV0uz3Ru","0","250","0000-00-00 00:00:00",NULL,NULL,"2023-08-14 02:34:51","iOhFCDKOsxPe",NULL,"1","1","0","1",NULL,"0","0",NULL,"$2a$08$VSQyGzs.7NOmt87XvMGElOmrAjdClSaEiSH0SRVqLRfA7nUlHMZMe",NULL,NULL,"0"
"763746","409881332060258306","b058cea2684fe73f2b588dfd1e43a65a","5PAT47rrUp5A","demetria#0","discord",NULL,"0","0","[email protected]",NULL,,"$2a$08$7FoU/SrX8N2EhaA2kA3F3OXQS/FxsuKN6zH56vYTrYckuGAToiXY6","0","250","0000-00-00 00:00:00",NULL,NULL,"2023-08-14 02:35:17","2IePa0gCZ86s",NULL,"1","1","0","1",NULL,"0","0",NULL,"$2a$08$hOX7.MUvX.Tn5nPAFFw3wOWpj6ux6TJo.HVsJvmw221gaFsMjiCea",NULL,NULL,"0"

网络安全专家证实，根据提供的测试样本，并通过Discord.com/login上的密码恢复进行验证，这些数据中包含的登录信息（登录名/电子邮件地址）是有效的，并与真实的Discord用户相对应。这意味着该数据库可能被用于网络钓鱼、发送垃圾邮件或其他欺诈活动。

Discord官方尚未对此发表评论。建议Discord用户更改密码并启用双因素身份验证。