Discord data breach at Double Counter bot exposes 28M accounts

A Discord breach that started outside Discord

The headline number is 28 million Discord accounts, but Discord's own systems were not the ones breached. The intrusion hit Double Counter, a third-party verification and anti-alt-account bot run by the French company Tellter SAS. Hundreds of thousands of Discord communities use it to screen new members.13 Discord has said its platform was not compromised. It has also stopped new installations of the Double Counter app while it reviews what happened.137

By Double Counter's account, the attack on October 4, 2026 was "deliberate" and "multi-stage." The intruder spent nearly six hours inside its cloud environment, copied about 12 GB of database tables, took over the bot's Discord token, and used a stolen payment key to commit fraud.113 The company notified France's data protection regulator, the CNIL, on October 5. That falls within the GDPR's 72-hour window. Tellter has also filed a criminal complaint.16

The incident fits the third-party risk pattern found in many current breaches. A small vendor collects identity data for millions of people on behalf of a much larger platform, and its security never grows to match that responsibility.

How the attacker got in: a forgotten server

The entry point was not a new exploit against a major platform. It was a retired server from Double Counter's old OVH hosting setup that was still running a self-hosted Metabase analytics instance.13 Probing from rotating VPN addresses began at 04:37 UTC on October 3. The attacker got in through the Metabase flaw at 00:47 UTC on October 4.168 According to the incident report, the vulnerability let the attacker forge an administrator session and reach credentials stored on the host. The report does not name a CVE or the affected Metabase version.

That gap matters for anyone tracking vulnerabilities. Without a CVE identifier, defenders running Metabase cannot easily tell whether this was a known, already-patched bug that went unpatched on an abandoned machine, or something newer. One technical write-up calls the tool "unpatched."8 The vendor's own report does not commit either way. The reasonable reading is that this was a patch-management failure on infrastructure nobody owned anymore, not a true zero-day. Until the version is disclosed, though, that remains an inference.

The server held two powerful credentials: a cloud service-account key with administrator rights and a saved administrator command-line session. Both were legitimate identities, so the attacker's activity looked like normal administration at first.5 Cloud access started at 12:03 UTC. Within minutes the attacker had added an SSH key, exported a database to a storage bucket they created, and opened a shell inside a running bot container to read the Discord token.8

Hijacking a trusted bot

The stolen token turned a data theft into an active attack on Discord communities. Starting at 13:30 UTC, the attacker used the bot to post invitations to their own server in about 50 large communities. To members, these looked like ordinary Double Counter messages.8 The attacker also gave their own account administrator rights on Double Counter's support server and reversed a staff ban.

The report is unusually frank about how hard containment was. Rotating the token did not work the first time, because the attacker still had access to the infrastructure and grabbed the replacement token within about two minutes.13 The attacker then deleted backups they had created, changed the database administrator password, and copied tables between 15:09 and 15:34 UTC. When responders disabled the service-account key, the attacker switched to the stolen administrator session. Access only ended when those sessions were revoked around 17:55 UTC.5 Service came back at 19:19 UTC with new credentials.

A stolen Stripe key belonging to Atis, a separate Tellter product, was used for $7,316 in fraudulent charges, mostly against a company card. Two customer charges totaling $18 were refunded.17

Reading the 28 million figure correctly

Outlets agree on the vendor's numbers but frame them very differently. Double Counter treats about 28 million Discord user IDs and usernames as exposed. It gives similar figures for about 27 million IP addresses with coarse location data (country, region, city, postal code and ISP), about 25 million user-agent hashes, and about 1 million deduplicated email addresses.11 These sets overlap, so adding them together would overstate the number of people affected.52

The 28 million is also a precautionary count. The verified-users IP table had about 21.7 million rows, and an estimated 20% had been copied when the transfer was cut off. Because nobody can tell which rows left, the whole table is counted as exposed.8 By contrast, the dataset actually released publicly is much smaller. Have I Been Pwned lists 274.9k email addresses, added on October 7. The records include Discord usernames, plus names, countries and postcodes for some paying subscribers who bought through Stripe.1

Some coverage gets this wrong. One gaming outlet said "login credentials" were partially copied. It also attributed the legal action to Discord, when it was Double Counter that hired lawyers and is pursuing the attacker in France and the United States.414 Neither point holds up. Discord passwords never passed through Double Counter, and the vendor says no stored card numbers were exposed.16 A breach-tracking site went the other way and gave 275,000 as the total number of people affected, which leaves out the larger exposure the vendor itself reports.6

The fairest summary sits between the two extremes. Roughly 275,000 email-and-username records have been confirmed in public circulation. A much larger set of IP and location data may be in the attacker's hands but has not appeared publicly. Several other stores were not affected: a cold-storage database covering about 58 million users, the behavioral fingerprint store, and 15 million VPN detection logs.

Why IP and location data is the real problem

The exposure is serious even without passwords. Pairing a Discord ID with an IP address, an ISP and a postal code is exactly what police and courts usually need a legal order to obtain when tying an online account to a real person. That data is now held by an attacker who needed no such order.16 The user-agent hashes are one-way, but they stay stable for a given user and can be used to link records. For some subscribers, an email address combined with a name, country and postcode comes close to a full identity profile.8 Discord's user base skews young, and some of those affected may be minors. The source material does not confirm ages.6

The incident also raises questions about how Discord's ecosystem works. Bots that log every new member across thousands of servers build up datasets the size of a mid-sized ad-tech company's, usually without the logging, network segmentation or credential rotation that scale calls for.2 Some commentators argue Discord should require data minimization and audits for verification bots. Discord's response so far has been to freeze new installs and stress that its own platform was not breached. That is accurate, but it does little for users whose data was collected because they joined a server.7

Threat intelligence and what defenders should take from it

No ransomware was reported, and no threat actor has been credibly identified so far. Threat-tracking accounts list the actor as unspecified.1013 Double Counter has published the attacker's Discord ID, the observed username-enumeration targets, and the time window of the malicious messages. Those indicators are useful to server moderators.8

The report's main lesson is that ordinary techniques were enough. The attacker scanned, exploited an exposed app, used valid credentials, read secrets from running systems, and abused a trusted identity. The weak points were administrative: an orphaned server, a key with too many permissions, a database exposed to the internet, and backups the intruder could delete.8 Double Counter has since removed long-lived service-account keys, moved bot tokens into a dedicated secret store with read logging, taken its cache database off the internet, and audited 14 cloud projects with no sign of remaining access.16

Server administrators should check audit logs for any Double Counter actions on October 4 between 12:00 and 16:30 UTC and remove anything they did not authorize. Members should avoid servers that Double Counter appears to promote.1417 The vendor tells Doogle, advertiser and API customers to expect phishing. Even users only in the IP dataset should treat unexpected messages that mention Discord or Double Counter with suspicion and turn on two-factor authentication.2

The verdict

The vendor responded quickly and openly. Its minute-by-minute timeline, its admission that the first token rotation failed, and its conservative exposure counts are more detailed than most corporate breach disclosures.8 Still, the breach should not have been possible: one forgotten analytics server with administrator credentials on it was enough. Discord's suspension of new installs is a start. Over time, Discord will have to decide whether third-party bots that hold IP and location data for tens of millions of its users should face the same security requirements as the platform itself.