Double Counter, a platform that offers protection for Discord communities against raids and the creation of alternate accounts, recently fell victim to a significant data breach. The incident resulted in the exposure of roughly one million email addresses, alongside partial copies of Discord identifiers and IP address information for a far larger user base. According to the company’s own incident report, which was shared through the security firm RPS, the breach was the result of a "deliberate, multi‑stage attack" that took place on October 4. The attackers identified and exploited a flaw in an analytics tool that was publicly accessible on an older server infrastructure.
This vulnerability granted them temporary access to the cloud credentials that powered Double Counter’s services, allowing them to remain inside the environment for just under six hours before being detected. During that window, the malicious actors were able to extract a substantial amount of data.
The company disclosed that Discord IDs and usernames associated with approximately 28 million accounts were partially copied. In addition, IP addresses and broad geographic location data for about 27 million users were also taken. Double Counter has classified all of this information as compromised and is treating it as exposed data.
The breach has been tracked by several monitoring services, including the popular breach‑notification site Have I Been Pwned, which now lists 274,900 email addresses and Discord usernames that have been publicly posted online. For customers who paid for Double Counter’s premium features, the leaked records also contained personal details such as full names, country of residence, and postal codes. Beyond the theft of user data, the attackers also managed to obtain a bot token that belonged to Double Counter. Using this token, they infiltrated roughly fifty large Discord servers and posted malicious links intended to deceive members and potentially spread further malware or phishing attempts.
The criminal operation also involved financial fraud: the perpetrators made unauthorized charges totaling $7,316 on a separate payment account linked to the service. In response to the intrusion, Double Counter took a series of emergency mitigation steps. The stolen credentials were immediately disabled, and all secret keys and access tokens were rotated to prevent further unauthorized use. The company also migrated its databases to private, more secure network segments to reduce exposure to external threats.
Service availability was restored later on the same day, October 4, and the organization promptly reported the incident to the French data protection authority, the CNIL, on October 5, complying with regional regulatory requirements. For ordinary Discord users, Double Counter has indicated that no direct action is required on their personal Discord accounts. However, server administrators are urged to review any messages that may have been sent by the compromised Double Counter bot on October 4 and delete any suspicious content to protect their communities from lingering malicious links. The timing of this breach coincides with Discord’s ongoing efforts to re‑introduce an age‑verification system across its platform.
Earlier in the year, Discord announced that it intended to require all users to verify their age starting in March. That rollout was later delayed until the second half of 2026 due to concerns about user privacy and the practicality of the verification process.
Stanislav Vishnevskiy, the co‑founder and chief technology officer of Discord, admitted that the company should have been more transparent about its verification plans and the mechanics behind them. After a period of reevaluation, Discord resumed its verification initiative at the end of the previous month, opting for alternative methods that avoid the need for video selfies or the submission of government‑issued identification documents. Overall, the Double Counter breach underscores the growing challenges that third‑party services face when handling large volumes of user data for platforms like Discord.
It highlights the importance of rigorous security audits, especially for legacy systems that may still be exposed to the internet, and reinforces the need for swift incident response procedures to limit damage when a breach does occur. Users and server owners are encouraged to stay vigilant, monitor for any unusual activity, and follow best practices for account security, such as using strong, unique passwords and enabling two‑factor authentication wherever possible.