TL;DR: Users who recently played Arc Raiders with Discord open may have unknowingly exposed private conversations and Discord login credentials. The game was writing this information to a local log file, which could potentially be accessed by other software on the device and even attached to crash reports.
Developer Embark Studios has acknowledged that Arc Raiders' Discord SDK logged more user data than intended and issued a hotfix to address the problem. The studio says Discord logging has now been disabled while the team investigates to ensure no deeper issues remain.
Blogger Timothy Meadows published code from Arc Raiders' Discord integration showing that the game's log file contained unencrypted private conversations from the chat client. If a player sent direct messages to friends on Discord while the extraction shooter was running in the background, those messages were written in plaintext to a file on the user's machine, located at C:\Users\AppData\Local\PioneerGame\Saved\Logs.
More concerningly, the logs also contained Discord bearer tokens, effectively creating a connection identical to the one used by the chat app itself. That connection handles all Discord events, potentially granting access to messages, friend lists, servers, settings, and account logins.
Discord users who never played Arc Raiders may also have been affected. The log file included online status, activity data, and metadata for everyone on the friend lists of Arc Raiders players. As a result, the issue could represent a serious privacy violation, impacting users who never agreed to the game's Terms of Service.
The Arc Raiders patch notes for March 3 (the same day Meadows published evidence of the issue) do not mention the hotfix. However, in a post on the game's official Discord server, included in Meadows' blog post, Embark said no personal data was transmitted from users' machines and stressed that the company would never deliberately access private information.
Still, the log file may have been bundled with crash reports. That means players who experienced crashes and submitted reports before the hotfix may have inadvertently sent Embark their private Discord messages and login tokens.
Users concerned that their tokens may have been exposed should change their Discord passwords, which will invalidate existing tokens. Players who don't need Discord chat while playing Arc Raiders can also disable the game's Discord integration in the settings.