Double Counter, a platform that offers protection for Discord communities against raids and the creation of alternate accounts, has recently suffered a significant data breach. The incident resulted in the exposure of approximately one million email addresses, and it also involved the partial extraction of Discord user IDs and IP address information belonging to millions of other users. According to the incident report released by the company through the Ransomware Protection Service (RPS), the breach was the result of a "deliberate, multi‑stage attack" that took place on October 4.
The attackers took advantage of a vulnerability in an analytics tool that was publicly accessible on an older server infrastructure. This flaw granted them access to the cloud credentials used by Double Counter, allowing them to remain inside the environment for just under six hours before the intrusion was detected. During that window, the malicious actors were able to copy Discord IDs and usernames associated with roughly 28 million accounts. In addition, they harvested IP address data and coarse geographical location details for about 27 million users.
Double Counter has classified all of that information as compromised and potentially exposed to further misuse. The breach has been catalogued by the breach‑tracking service "Have I Been Pwned," which reports that 274,900 email addresses and Discord usernames have already been posted publicly on the internet. For customers who paid for Double Counter’s premium services, the leaked records also contained personal identifiers such as full names, country of residence, and postal codes, adding another layer of sensitivity to the breach. Beyond the data theft, the attackers also managed to steal a bot token that powers Double Counter’s integration with Discord.
Using this token, they posted malicious links across roughly 50 large Discord servers, potentially exposing members of those communities to phishing attempts or malware. In a separate financial maneuver, the perpetrators made fraudulent purchases amounting to $7,316 on a distinct payment account that was linked to the compromised service. In response to the incident, Double Counter took immediate remedial actions. The stolen credentials were disabled, all secret keys were rotated, and the company migrated its databases to private, more secure network segments.
Service availability was restored on the same day of the attack, October 4, and the firm promptly notified France’s data protection authority, the CNIL, on October 5, in compliance with European privacy regulations. For ordinary Discord users, Double Counter advises that no direct action is required on their personal Discord accounts.
However, server administrators are urged to review their server logs and delete any messages that appear to have been sent by Double Counter on October 4, as those could contain malicious links or other unwanted content. The timing of this breach is noteworthy because Discord is currently in the process of re‑launching its age‑verification system. Earlier in the year, Discord announced that a mandatory age‑verification step would be rolled out to all users starting in March. That rollout was subsequently delayed until the second half of 2026 due to concerns over user privacy and the handling of sensitive biometric data.
Co‑founder and Chief Technology Officer Stanislav Vishnevskiy admitted that Discord should have been more transparent about the objectives and mechanics of the verification process. The company only resumed its verification efforts at the end of last month, after introducing alternative verification methods that do not rely on video selfies or government‑issued identification.
Overall, the Double Counter breach underscores the growing challenges that third‑party services face when handling large volumes of user data, especially in ecosystems like Discord where community management tools are essential. It also highlights the importance of rigorous security audits for legacy systems and publicly exposed tools, as even a single overlooked vulnerability can provide a foothold for attackers to extract massive amounts of personal information. Users and administrators alike are reminded to stay vigilant, monitor for suspicious activity, and follow best practices for account security, such as enabling two‑factor authentication and regularly reviewing permissions granted to bots and integrations. While Double Counter has taken steps to mitigate the damage and secure its infrastructure, the incident serves as a cautionary tale for the broader Discord community and for any service that processes user credentials at scale.
Ongoing monitoring, prompt disclosure, and cooperation with regulatory bodies remain critical components of an effective response to such data‑security events.