Double Counter Discord Bot Breach Hits 28 Million Accounts

If you have ever clicked a verify button to get into a Discord server, there is a fair chance a bot logged your IP address before letting you in. Double Counter is one of the biggest of those bots, and its homepage says it is trusted by "600,000+ communities since 2020." Last week that database of IP addresses, tied to Discord accounts, was partly copied by an intruder.

The operator, Tellter SAS, published a detailed incident report on October 5. It is unusually candid, and it is the best source for the numbers, several of which have been garbled in secondary coverage.

Key Takeaways

• Double Counter says an attacker spent 5 hours and 51 minutes in its cloud on October 4, 2026, after entering through a Metabase analytics tool left running on a retired OVH server.
• Tellter SAS treats about 28 million Discord user IDs and usernames and about 27 million IP address and coarse location records as exposed, though both sets were only partly copied.
• About 1.0 million email addresses were copied, mostly from Doogle (about 840,000) and from dashboard, server manager, customer and advertiser contacts (about 240,000), not from ordinary verified members.
• Have I Been Pwned added 274,922 email addresses from a publicly posted subset on October 7, 2026, so a much smaller set is already circulating than the one the operator says was copied.
• Double Counter says no Discord passwords or stored card numbers were involved, and that the $7,316 in fraud ran through a stolen Stripe key for a separate product, Atis.

How Did the Attacker Get Into Double Counter?

They came in through a server the company had stopped using. According to the Double Counter incident report, the machine belonged to its "previous OVH hosting setup" and was no longer linked to the live service, but it was still running a publicly reachable, self hosted copy of Metabase. A vulnerability in that tool "let the attacker forge an administrator session" and reach the host.

The retired server held two keys to the real infrastructure: a service account key with administrator rights and an administrator's saved command line session. From there, all times UTC:

• October 3, 04:37: probing of the legacy server begins from rotating VPN addresses.
• October 4, 00:47: login to the legacy server through the analytics tool.
• 12:03: first use of the stolen service account key in the cloud.
• 12:26: shell inside a running bot container, bot token read.
• 13:30: the bot starts posting invites to the attacker's server in about 50 large Discord servers.
• 15:09 to 15:34: database tables copied, about 12 GB.
• 17:11 to 17:12: fraudulent charges through a stolen Stripe key.
• 17:54: last recorded attacker action. Service restored at 19:19.

The attacker also adapted in real time. When staff installed a new bot token, the report says the attacker "read it within two minutes," then deleted backups and changed the database administrator password to lock the company out.

Double Counter does not name a CVE. Metabase has been here before: in August, CVE-2026-72898 let unauthenticated attackers "gain administrator access" to Metabase instances, and it was used against Framework and three other companies. Whether the same flaw was used here is not stated by Double Counter, so treat any link between the two as unconfirmed.

What Data Was Exposed in the Double Counter Breach?

Discord identities, IP addresses with approximate locations, and about a million email addresses. The operator's own table, with its wording on what actually left:

• Discord user IDs and usernames: about 28 million accounts, "partly copied (treated as exposed)."
• IP addresses and coarse geolocation (country, region, city, postal code, ISP): about 27 million accounts, partly copied, treated as exposed.
• User agent hash (a one way hash of browser user agent, city and country, used for alt detection): about 25 million accounts, copied.
• Email addresses: about 1.0 million, copied.
• VPN detection logs: about 15 million, not copied.

The 28 million headline is a worst case, and the report explains why. IP records sit in two tables: an alt detection table of about 5.4 million rows that was copied in full, and a verified users table of about 21.7 million rows where the company estimates "about 20% had left" before it killed the session. By our arithmetic, that is roughly 9.7 million IP records actually out the door. Tellter treats all 27 million as exposed because it cannot tell which rows left, which is the right call for anyone deciding whether they are affected.

A separate cold storage database covering about 58 million users was not touched, the company says. Passwords were never in scope, because Double Counter never receives them.

Where Do the Reports Disagree?

Mostly on what was copied versus what merely existed. Four discrepancies are worth knowing:

• VPN records. Cybernews lists about 15 million VPN detection records under breached data. The operator's report marks them "Not copied."
• The card fraud. Cybernews describes charges on "credit cards saved in the system." The report says the attacker used a Stripe key for Atis, a separate Tellter product, to charge one of the company's own cards ($7,316 total) and two customers ($3 and $15, both refunded). No stored card numbers were exposed.
• The email count. About 1.0 million addresses were copied. Have I Been Pwned lists 274,922 from a corpus that was "subsequently published publicly," which also held names, countries and postcodes for a small number of Stripe paying subscribers. Who posted it is not stated.
• Discord's response. Outlook Respawn reported that Discord "confirmed that its systems were not breached" and blocked new Double Counter installations while investigating. We could not find Discord's statement itself, so that rests on the outlet's reporting.

Why Does a Discord Bot Hold Your IP Address?

Because matching IPs is how it spots alt accounts. The Double Counter privacy policy says your IP address is "Collected when you click the verification link" and is "Linked to your Discord ID." That link is the product: when a banned user rejoins under a new name, the shared IP gives them away.

The same data feeds a paid search tool. Tellter's Doogle product page describes it as "the investigation layer on top of Double Counter's data": paste a Discord ID and get alternate accounts, blocked VPN attempts and the servers the user is verified in. Plans run from 10 to 50 searches a day, and the Doogle documentation promises it "will never release sensitive identifiers such as IP addresses or device fingerprints." That promise covered the search interface. It could not cover the database underneath, and about 840,000 Doogle account emails were among the copied records.

Here is the comparison most coverage skipped. A verification check takes three seconds, and the homepage advertises a "3-second verification." The IP record it creates has no expiry date in the privacy policy we read, so it sits there as long as the company keeps it. The policy also says user agent data is "Temporarily cached" and "deleted automatically," yet the incident report lists one way user agent hashes for about 25 million accounts as copied. Those may be different data sets, but users have no way to tell from the outside.

This is the second time in a year that Discord users have been burned by data held one step away from Discord itself. In October 2025, a support vendor breach exposed about 70,000 government ID photos submitted for age checks.

Why Email Users Should Care

The copied email addresses belong to the most engaged slice of the user base: people who signed into the Double Counter dashboard, run servers, buy ads, use the API or pay for Doogle. The operator's own advice to that group is blunt: "your email address was exposed, so expect phishing attempts," and "We never ask for passwords, tokens or payment by email or private message."

Expect lures that cite the incident itself: a breach notice, a request to "reverify," a refund for the fraudulent charges. Each looks credible because the event really happened. The Have I Been Pwned listing means 274,922 of those addresses are now public and paired with Discord usernames.

The bigger risk is joining records. An email address from this leak plus a Discord username plus a city level IP location is the kind of pivot that turns a screen name into a real person, which is why EFF treats your email address as the key a doxxer starts from.

What Should You Do Now?

Check, then cut access, then ask for deletion. In order:

1. Search your email on Have I Been Pwned. A hit means your address is in the public corpus, not just the copied set.
2. Treat any Double Counter, Doogle or Discord branded email about this incident as suspect. Go to the site directly instead of clicking, and never send a token or password.
3. Review Authorized Apps. Discord's account security guide says to open User Settings, then Authorized Apps, and press Deauthorize on anything unwanted (on mobile, tap the x). This stops future access; it does not delete what a service already stored.
4. Request deletion. The policy says the /privacy command, then "Delete my data," removes your IP address, username, browser agent information and email, while "pseudonymized account-association linkages" are kept. Doogle look ups can be opted out of separately.
5. Server admins: delete Double Counter messages sent on October 4 between 12:00 and 16:30 UTC that invite people elsewhere, and check your audit log for bot actions in that window.

Members who verified between 13:39 and 14:49 UTC without receiving a role should verify again, the report says.

What Happens Next?

Tellter SAS notified France's CNIL on October 5, inside the 72 hour window set by Article 33 of the GDPR, and says a criminal complaint is being filed with counsel pursuing the attacker in France and the United States. Version 1.9 of the report promises updates when the investigation ends. The open questions are which Metabase flaw was used, whether Discord lifts its install block, and whether the public corpus grows beyond 274,922 addresses toward the million the operator says was copied.