I joined a Discord server and the people there somehow knew which other servers I had been in, what messages or images I had posted, and even what my previous profile pictures looked like. They seemed to identify me using only my Discord ID. I'm worried about how much information may be exposed and want to understand how they could have collected it and what I can do to protect myself.
3 Answers
A normal bot can access some information when it has the necessary permissions, but collecting a large history across unrelated servers usually involves multiple collector accounts, unauthorized scraping tools, or modified clients. Automating regular user accounts and scraping data this way generally violates Discord’s rules. If they showed you a lookup command or already knew details about other members, that makes a shared database or scraping system more plausible than someone discovering a vulnerability in your account.
Review your privacy and security settings, especially who can see your profile information and who can send you direct messages or friend requests. Leave servers you don’t trust, remove unfamiliar authorized apps, enable two-factor authentication, and change your password if you suspect account access. Running a malware scan is still sensible, but the fact that they knew about other users too points more toward scraped public data than your individual account being hacked. Save screenshots and report the server, bots, or users if they are threatening or exposing personal information.
The most likely explanation is data scraping. Automated accounts or bots can collect information from public servers they can access, then store it in a database linked to Discord user IDs. That can include visible profile details, messages, avatars, usernames, roles, and server activity. It wouldn’t be a complete record of everything you’ve ever done, though—it would only include information those accounts were able to see while they were present in particular servers.
That makes sense. They also knew details about other people who joined, so it sounds more like a database than someone having access to my account specifically.