[jeffparsons]

There is no reason for a company like Discord to ever see the ID. The owner of each relevant form of ID — usually a government agency/department — should provide an attestation service, such that users prove their identity to the agency and the agency tells the company "yes, this user is who they say they are".

It's not that hard. Legislators around the world are consistently dropping the ball on this.

[magicalhippo]

Doesn't seem like they did. From the original article I referenced earlier:

One of Discord’s third-party customer service providers was compromised by an “unauthorized party,” the company says. [...] The unauthorized party “did not gain access to Discord directly.”

[jeffparsons]

The third party company shouldn't ever need to see the IDs, either. Same issue.