Quick Answer
Double Counter says a breach exposed data tied to roughly 28 million Discord accounts after an attacker accessed its infrastructure on October 4, 2026. Discord says its own systems were not breached, but affected users should treat unexpected bot messages and verification links as suspicious, check whether their email appears in public breach data, and secure accounts that share reused credentials.
Key Takeaways
- Double Counter says Discord user IDs and usernames tied to about 28 million accounts were exposed.
- IP addresses and coarse location data tied to about 27 million accounts were also affected.
- Double Counter says approximately 1 million email addresses were copied during the incident.
- Double Counter says Discord passwords and stored payment-card details were not in the affected database.
- Discord disabled new Double Counter installations while it works with the bot operator on the incident.
What happened in the Double Counter data breach?
The Double Counter data breach began when an attacker exploited a vulnerability in a publicly reachable retired server running Metabase, according to Double Counter’s incident report. The attacker then found cloud credentials on that server and used them to access Double Counter infrastructure on October 4, 2026.
Double Counter says the attacker copied approximately 12 GB of database tables during a 25-minute period from 15:09 to 15:34 UTC. This matters because the incident involved a third-party Discord verification bot that handled account-related data, rather than a breach of Discord’s central systems.
Double Counter says it contained the attack and restored service at 19:19 UTC on October 4 with new credentials. The practical concern for users is not a Discord password reset caused by this incident alone, but the possibility that exposed identifiers, email addresses, or IP-related data could be used in targeted scams.
What data did the Double Counter data breach expose?
The Double Counter data breach exposed Discord user IDs and usernames tied to about 28 million accounts, plus IP addresses and coarse location data tied to about 27 million accounts. Double Counter also says approximately 1 million email addresses were copied from the affected database.
The exposed data does not appear to include Discord passwords or stored payment-card details. Double Counter says those records were not in the affected database, which reduces the risk of direct account takeover through stolen passwords or direct payment-card fraud from this specific incident.
That limitation does not eliminate risk. A Discord username, user ID, email address, IP address, and broad location signal can help an attacker make a phishing message look more credible. Users should be especially cautious when a message claims that a Discord server, moderation bot, account verification process, or payment record needs immediate attention.
| Data category | Accounts or records affected | Why the data matters |
|---|---|---|
| Discord user IDs and usernames | About 28 million accounts | Attackers can identify users and create convincing Discord-related scams. |
| IP addresses and coarse location data | About 27 million accounts | These records can reveal broad network and location patterns. |
| Email addresses | About 1 million addresses | Email addresses can be used for phishing or credential-reuse attempts. |
| Discord passwords and stored payment cards | Not in the affected database, according to Double Counter | The incident does not appear to expose those records directly. |
Was Discord itself breached?
Discord says its own systems were not breached in the Double Counter incident. Discord told Dexerto that it disabled new Double Counter installations while it works with the bot operator to understand the scope of the event, as described in Discord’s statement on the Double Counter incident.
Discord users should distinguish between a platform breach and a third-party service breach. Double Counter is a bot service used by Discord communities, so its exposure can affect people who interacted with servers using the bot without indicating that Discord’s account database or internal infrastructure was compromised.
The distinction matters because users should not assume that a Discord password change is mandatory solely because of the Double Counter data breach. Users who reused a Discord password on another service should still change that reused password, because credential reuse creates a separate account-security problem regardless of what Double Counter says was stored.
How can affected Discord users check for exposed data?
Discord users can check whether an email address appears in the publicly released Double Counter breach corpus through Have I Been Pwned’s Double Counter breach listing. Have I Been Pwned says the public corpus contains 274,900 unique email addresses and Discord usernames, which is smaller than Double Counter’s broader estimate of affected accounts.
The difference between those figures is important. Double Counter’s estimate describes data the company treats as exposed during the incident, while Have I Been Pwned’s count describes records in a publicly released corpus. An email address not appearing in the public corpus does not establish that no Double Counter-related data was accessed.
Have I Been Pwned also says a small number of Stripe subscriber records included names, countries, and postcodes. Users who find an email address in the listing should watch for scam emails that mention a Discord community, bot subscription, billing record, or account verification request.
What should Discord users do after the Double Counter data breach?
Discord users should secure accounts that reuse passwords, enable multi-factor authentication where available, and avoid opening unexpected verification links. The Double Counter data breach did not reportedly include Discord passwords, but exposed contact and account-identifying data can make fraudulent messages more tailored and believable.
- Check whether your email address appears in the Double Counter listing on Have I Been Pwned.
- Change any password that you reused between Discord, email, and other accounts.
- Enable multi-factor authentication on your Discord account and email account.
- Review recent Discord direct messages, server invitations, and authorization requests for unfamiliar activity.
- Reject messages that ask you to scan a QR code, enter a password, or authorize a bot without confirming the request through a trusted server administrator.
Discord users should also be careful with security prompts that impersonate familiar bots. The risk is higher because attackers used a stolen bot token to post links to an attacker-controlled Discord server in about 50 large Discord servers, according to Double Counter. Users concerned about suspicious automation should understand how bot and app account labels can help identify nonhuman accounts, although a label does not prove that a message is safe.
Why were malicious links posted through Double Counter?
Malicious links were posted through Double Counter because attackers obtained a bot token during the intrusion, according to Double Counter. The attackers used that token to post links to an attacker-controlled Discord server in about 50 large Discord servers.
A bot token functions as a credential that lets an authorized application act through a bot account. When an attacker obtains such a token, the attacker can send messages that appear to come from a legitimate bot, which makes the messages more persuasive than ordinary spam from an unknown account.
The practical response is to avoid interacting with any unexpected Double Counter message, even if the message appears in a server you recognize. Discord communities should review bot permissions and remove or restrict integrations they no longer need. The incident also illustrates why users should remain cautious about attacks that reach devices without an obvious warning, especially when a trusted-looking message asks for urgent action.
What has Double Counter done since the October 4 attack?
Double Counter says it restored service with new credentials at 19:19 UTC on October 4, after containing the incident. Replacing credentials matters because the attacker accessed Double Counter infrastructure with cloud credentials found on the retired Metabase server.
Double Counter also says it notified France’s CNIL data-protection authority on October 5 under reference FR2610050000001. The company says it is preparing a criminal complaint in France and the United States, although the report does not establish when those complaints will be filed or what action authorities may take.
Double Counter’s account of the incident points to a retired internet-facing server as the entry point. Organizations that operate Discord bots or other online integrations should remove public access to retired services and rotate credentials when old infrastructure may have contained sensitive access data. Similar incidents involving exposed credentials and source-code access show why old systems can remain a security risk after they are no longer in active use.
Should Discord server owners remove Double Counter?
Discord server owners should review whether they still need Double Counter and should wait for the operator’s guidance before attempting a new installation. Discord says it disabled new Double Counter installations while it works with the bot operator to understand the incident’s scope.
Server owners should also inspect recent bot activity, remove suspicious messages posted by the bot, and notify members not to follow unexpected links. A server announcement should explain that the affected service was a third-party bot and that Discord says its own systems were not breached, because clear context can reduce panic and limit the effectiveness of follow-up scams.
Server owners should stop and contact Discord support or Double Counter support if they find unexplained bot permissions, unauthorized role changes, or messages that cannot be removed through normal server controls. Administrators should not share bot tokens, screenshots containing credentials, or member data while seeking help, because those records could create additional exposure.
FAQ
Did the Double Counter data breach expose Discord passwords?
No, Double Counter says Discord passwords were not in the affected database. The company also says stored payment-card details were not included in the affected records.
How many accounts were affected by the Double Counter data breach?
Double Counter says Discord user IDs and usernames tied to about 28 million accounts were exposed. The company says IP addresses and coarse location data tied to about 27 million accounts were also affected.
Was Discord hacked in the Double Counter incident?
No, Discord says its own systems were not breached. The incident involved Double Counter, a third-party Discord verification bot, and Discord disabled new installations while it reviews the scope with the bot operator.
Should I change my Discord password after the Double Counter breach?
No, a password change is not required solely because of the Double Counter breach, because Double Counter says Discord passwords were not affected. Change your password immediately if you reused it on another account or notice suspicious Discord activity.
How can I check whether my email was in the Double Counter breach?
Have I Been Pwned lists the Double Counter breach and lets users check email addresses against its breach data. The public corpus contains 274,900 unique email addresses and Discord usernames, according to the service.