Hundreds of Millions of Discord Messages Scraped and Up for Sale
A massive data scrape involving public Discord messages has surfaced on a well-known cybercrime forum, with a threat actor claiming to have collected over 348 million messages from nearly 1,000 public servers. The dataset reportedly spans close to a year of conversations and allegedly includes user activity from the United States, France, and Russia.
The seller shared a sample of the data, which contains various user identifiers and message metadata, including User IDs, Usernames, Display Names, Nicknames, Message Content, Guild IDs, Channel IDs, Message IDs, Reply IDs, and Timestamps. While no private messages or non-public data appear to be included, Cybernews researchers reviewed the sample and found no immediate signs that the data is fake.
Scraping public Discord messages isn’t particularly complex for someone with the right skills. However, the danger lies in aggregating and cross-referencing that information, which can lead to highly targeted harassment. As a researcher Aras Nazarovas pointed out, such a dataset makes it far easier to browse someone’s entire message history across multiple public servers—opening the door to misuse.
This isn’t the first time Discord has been at the center of such controversy. Earlier in 2024, a shady platform known as Spy.pet emerged, claiming it had scraped billions of public Discord messages from 620 million users. The site reportedly allowed users to link scraped Discord data with platforms like Steam, and even offered an “enterprise option” for organizations—including, allegedly, government agencies—interested in training AI models on the harvested content.
Spy.pet required cryptocurrency payments to access server archives and user profiles. Although it had been quietly operating since late 2023, it only gained significant attention in early 2024, prompting Discord to take action. The site was found to violate several data privacy regulations, including the General Data Protection Regulation (GDPR), and was eventually taken offline.
Despite its takedown, Spy.pet’s admin told 404 Media that the site was not intended for harassment—an unconvincing claim considering it had been promoted on Kiwi Farms, a forum notorious for doxxing and targeting marginalized communities, including women and LGBTQ+ individuals.
With this new data leak echoing similar risks, concerns are growing that the scraped information could again be used for surveillance and harassment, particularly against vulnerable groups. Discord has yet to respond to inquiries regarding the breach.
