Discord protection bot Double Counter hit by breach exposing around 1 million email addresses

Double Counter, a Discord protection service against raids and alt accounts, experienced a data breach exposing approximately one million email addresses, alongside millions more users' Discord IDs and IP addresses. The incident report attributed to the company detailed a calculated, multi-part assault on October 4. The attackers capitalized on a weakness in a public analytics tool on an outdated server, granting them access to cloud credentials for just under six hours.

Subsequently, about 28 million Discord accounts saw their IDs and usernames partially stolen, along with IP addresses and coarse location data for roughly 27 million accounts. Double Counter classified all this data as compromised. Breach tracker Have I Been Pwned reported that 274,900 email addresses and Discord usernames have since been made public.

Records for paying customers included names, countries, and postal codes. The attackers also pilfered a bot token, which they utilized to disseminate malicious links in approximately 50 large Discord servers, resulting in $7,316 in fraudulent charges on a separate payment account. Double Counter stated they had disabled the stolen credentials, rotated their secrets, and relocated their databases to private networks.

Service was restored on October 4, and they reported the incident to France's data protection authority, the CNIL, on October 5. Members of affected servers do not need to take any action regarding their Discord accounts, according to the company. They advised server administrators to delete any dubious Double Counter messages from October 4.

This breach occurs as Discord endeavors to relaunch its age verification system. Initially announced in February, age verification was set to commence for all users in March. However, the rollout was delayed to the second half of 2026 due to privacy concerns. Double Counter's co-founder and chief technology officer, Stanislav Vishnevskiy, acknowledged that Discord should have provided more insight into its plans and the verification process.

The company only resumed its verification efforts at the end of last month, having introduced alternative methods that do not necessitate video selfies or identification.