03 DECEMBER 2023 (upDated)
Mushroom.gg, one of the largest bots on Discord, has allegedly leaked sensitive user information.
Mushroom, a popular Discord bot created in 2020, is alleged to have exposed sensitive user data in a recent data breach.
The alleged data breach, which is said to have exposed an estimated 28 million Discord users information, 5 million guild/server entries, as well as leaking over 6,000 user email addresses.
Cyber-security data analyst (stealing.info), reported that the sensitive data, which was reportedly made public on 28th February 2023 for a test server, was not password protected leading to the data to be visible online. Once realising the error, the data was removed within 24 hours.
Despite Mushroom's fast response to the data breach, for Discord users that have the Mushroom bot in their guild/server, information regarding Mushroom ID, Discord ID, and Discord email address, were leaked.
The data leak included both non-sensitive and sensitive data, which could include:
Non-sensitive data:
- User avatar.
- User status, e.g. mod/admin/public.
- Registration date.
- Username
- Discord ID
- Email address
- Billing information
According to GDPR law, Article 33 states in case of personal data breaches a company must release a statement and notify those involved within 72 hours of knowing about the breach.
Nine months after the alleged data breach, Mushroom.gg released a statement saying "We also want to acknowledge the recent talk of a potential data exposure.
"We investigated it at the time, immediately took action to mitigate any potential harm, and did comply with all applicable legal obligations.
"We value the trust you have placed in us when using Mushroom, and we have worked very hard to protect your data."
A data breach like this does violate Discord's Terms of Service, however the social media platform has yet to comment on the situation.
The Mushroom Discord bot is currently in 140,000 Discord servers and has a 4.4 star rating on top.gg.
The writer of the initial article published on stealing.info, stated that "Mushroom handled the report pretty well in my opinion, they took action fast (24h ish) and actually looked into the issue in order to work out how many users were potentially affected, so kudos to them.
"In future, I would recommend being more transparent about the issue, but otherwise you did a good job."
Mushroom.gg announced that on 30th November 2023, they are discontinuing their services with immediate effect.
In their closing statement, Mushroom stated "Thank you for being part of this journey, for every game, every post, and every moment of camaraderie. We're deeply appreciative of you all giving us a chance to serve you."
Images from Mushroom.gg