Double Counter bot breach exposes millions of Discord user data points

Double Counter, a server protection service used on the Discord platform, has suffered a multi-stage data breach. The incident, which occurred on October 4, involved attackers exploiting a vulnerability in a publicly accessible analytics tool on a legacy server to gain cloud credentials.

Reports indicate that approximately 1 million email addresses were exposed. Additionally, Discord IDs and usernames for roughly 28 million accounts were partially copied, while IP addresses and coarse location data for about 27 million users were also compromised. For a subset of paying subscribers, the breach included names, countries, and postal codes. The breach tracker Have I Been Pwned confirmed that approximately 275,000 unique email addresses and usernames have been released publicly.

During the attack, which lasted just under six hours, the perpetrators stole a bot token to post malicious links in approximately 50 large Discord servers and made over $7,000 in fraudulent charges. Double Counter has since disabled the stolen credentials, rotated secrets, and moved databases to private networks. The company notified France’s data protection authority, CNIL, regarding the incident. While users do not need to take action on their Discord accounts, administrators are advised to delete suspicious messages from the date of the breach.