People often underestimate how important their data is to others, which is why they believe their information would be left alone. Unfortunately, bad actors who exploit user data aren't all that picky. Millions of users had their data collected for selling, but Discord is already investigating the matter.
Discord Investigates Selling of User Data
With something as big as a data scraping service known as Spy Pet, acquiring data from hundreds of millions of Discord users, you'd think that the company would immediately take action. It took more time for Discord to decide on a course of action.
Fortunately, the final decision led to the company investigating the case. The accounts that were behind the data scraping have already been banned from the platform, and Discord is already considering legal action against the bad actors, as reported by Eurogamer.
"Based on our investigation, the accounts accessed Discord servers that were open and available for anyone to join or where the accounts had easy access to a valid invite link. Once in these spaces, these accounts could only access the same information as any other user in those servers."
Before action was taken, Spy Pet supposedly had access to around four billion public messages, voice data, and thousands of servers for popular games. These are then put up for sale, and anyone can buy data from certain users for just $5.
Spy Pet advertised the data for sale as a resource for AI companies to use as training data, or "federal agents looking for a new source of intel." Either way, it is both unethical and illegal on many accounts as private messages are meant to stay private.
The creator behind the data scraping service was asked why he did what he did, and responded by saying that he liked "scraping, archiving, and challenging" himself. "Discord is basically the holy grail of scraping," he added, as per Engadget.
While the matter has moved on from being investigated to considering legal action, Discord is on the right track of things. Hopefully, there is no data sold to other bad actors yet, and if there is, it won't be used for malicious activities like scams.
Why This is Concerning
The lack of action, in the beginning, means that the data scraping service has had time to potentially make sales. That means some user's data is already in the hands of someone with unclear intentions. Since they are private messages, the data can range from simple chatter to sensitive information.
This can be used by threat actors to conduct fraudulent activities like calling phone numbers, sending infected links to emails, and more. Even the data being acquired by AI companies puts the users at risk.
When used as training data, the user's information will now be part of the database that an AI model can pull information from. That means that with the right prompt, their details can be revealed to random strangers using AI products.
