>The unauthorized party also gained access to a small number of government ID images (e.g., driver’s license, passport) from users who had appealed an age determination.
https://discord.com/press-releases/update-on-security-incide...
Users only upload their government ID to Discord when the "Face Scan" [0] incorrectly estimates their age as being less than 18. Discord could reasonably classify this as a "small number" of users who need to upload their government ID image. That wouldn't preclude it from also being every user who needs to upload their government ID image — unless there is some other system that also requires them to upload it?
With that in mind, here's a rephrasing of the same statement:
> The unauthorized party also gained access to all uploaded government ID images.
Their press release does NOT say it's a small subset of photo IDs. It says a "small number" of government ID images — nothing about percentages. This would be consistent with the "small number" of users who need/choose to appeal an incorrect age estimation from Face Scan.
[0] https://support.discord.com/hc/en-us/articles/30326565624343...
(To say nothing of... does it matter the amount of IDs leaked?)
For example if the face verification failed and you need to file an appeal which requires uploading government ID. That's likely sizeable number of users, especially since the breach happened shortly after the requirement was implemented and many existing users had to do it.
They intentionally chose NOT to disclose a date range or even how many ID tickets compared to standard tickets were leaked.