Data tied to an estimated 28 million Discord accounts was treated as exposed after an attacker broke into the systems behind Double Counter. The third-party verification bot runs on servers outside Discord’s own platform, so this incident affected the bot provider, not Discord’s core systems. That distinction matters when you judge what may have happened to your account.
The exposure estimate covers overlapping records, while a much smaller file of email addresses and usernames became public. Some records were reportedly copied, and others were treated as exposed because attackers accessed the systems that held them. Coarse geolocation means an approximate location inferred from network data, such as a region or city rather than a precise GPS position. The key distinction for users is that a large exposure estimate does not mean 28 million confirmed Discord accounts were individually compromised.
Key Takeaways
- The incident affected Double Counter’s systems, not Discord’s platform.
- Data tied to about 28 million accounts was treated as exposed, but the records overlap.
- The public email file contains far fewer records than the broader estimates.
- Passwords were not held by the bot provider and were not exposed.
- A clean email lookup cannot rule out every record in the wider exposure.
- Server owners can review audit logs for suspicious bot activity.
What Happened in the Double Counter Discord Bot Breach 28 Million Accounts 2026?
The intrusion began on October 4, 2026, and attackers copied roughly 12 GB of Double Counter data before their access ended. Tellter SAS operates the verification bot, and the intrusion reached systems within its infrastructure. The Discord data breach in October 2026 was a third-party service incident, not a breach of Discord itself.
The attack lasted just under six hours, but the copying took much less time. Attackers copied data between 15:09 and 15:34 UTC, a window of 25 minutes. The intrusion window and the data-copying window describe different parts of the event.
The 12 GB figure describes the copied data, not a verified count of individual people.
The time between the start and end of the intrusion covers the attackers’ access, not just their file copying. That wider period matters because a network intrusion can include steps before and after data leaves a system. The shorter transfer window records when the reported copying took place.
Tellter SAS restored Double Counter service at 19:19 UTC on October 4. Restoration happened after the copying window and before the incident became public. The attack therefore involved both unauthorized access to the provider’s systems and a later service response.
The 12 GB total does not translate directly into people affected. A copied database may contain repeated records, account links, or other data that does not represent a new person. The reported exposure estimates also cover datasets that overlap, rather than separate groups that can be added together.
That distinction is important if you see a headline that connects a large storage figure to a precise number of victims. The volume helps describe how much data moved, but it cannot confirm how many people had unique records inside those files.
The incident report places the attack on Double Counter’s side of the connection. It does not describe a break-in to Discord’s platform or its central account database. The 12 GB figure describes the copied data, not a verified count of individual people.
What Data Was Exposed?
The exposure figures describe overlapping sets of records, so they cannot be added together to produce a reliable count of individual people. Some records were treated as exposed, while others were reportedly copied. The distinction helps explain why the estimates do not equal a confirmed number of victims.
About 28 million accounts’ data was treated as exposed, but the reported categories overlap. The figures below describe different kinds of data tied to the same users, not separate groups of people.
| Data category | Reported scale | Exposure description | Important qualification |
|---|---|---|---|
| Discord IDs and usernames | About 28 million accounts | Treated as exposed, partly copied | Overlapping dataset |
| IP addresses and coarse geolocation | About 27 million | Reportedly exposed | Overlapping dataset |
| User-agent hashes | Around 25 million accounts | Reportedly copied | Not a separate victim group |
| Email addresses | Around 1 million | Reportedly copied | More than the public release |
Records Tied to Discord Accounts
Discord IDs and usernames can connect records to accounts, while IP addresses and coarse geolocation can point to a network’s general area. User-agent hashes describe browser or device details in a coded form. Those categories can refer to the same account, so their totals must not be added as if each represented a different user.
The 28 million account figure is an estimate of data treated as exposed, not proof that attackers downloaded every record. The reported copying figures also differ by data type. That is why the table uses words such as “about” and “around” rather than presenting each estimate as an exact head count.
The Public Email-and-Username Dataset
A publicly released file contained 275,000 unique email-and-username records. It also included names, countries, and postcodes for a small number of paying subscribers. That release was much smaller than the roughly one million email addresses reportedly copied during the wider incident.
Two separate datasets were reported as unaffected: a cold-storage database covering about 58 million users and the behavioral data database. Double Counter did not hold Discord passwords, and passwords were not exposed in this incident.
A record in the public file may include information that does not appear in another reported category. The public release therefore offers one view of the incident, not a complete account of all data involved. Treat an email address in the public file as one part of the reported exposure, not as a measure of the full incident.
How Did Attackers Get Into Double Counter?
The attack began on a former OVH server that was no longer part of Double Counter’s active hosting setup but still exposed an analytics tool to the internet. A vulnerability in Metabase, the analytics tool, gave attackers a foothold. Retired infrastructure can remain a risk when it stays reachable.
The initial weakness was part of a chain, not the only security failure. Credentials left on the old server gave attackers a route toward Double Counter’s cloud infrastructure. The intrusion shows why old systems need the same access checks as active ones.
A Public Analytics Tool on an Old Server
The former OVH server belonged to an earlier hosting setup. Double Counter had moved on, but the machine remained online with a public Metabase interface. Attackers could reach that tool from the internet instead of needing an existing account or an invitation.
They used a vulnerability in the tool to obtain administrator credentials. Those credentials gave them a stronger foothold on the server. The incident does not establish a specific vulnerability identifier, and it does not show that Metabase alone caused the breach.
A public analytics tool can expose more than charts. Depending on its setup, it may connect to data, store account details, or hold credentials used by other systems. The old server’s continued access mattered because attackers could use it as a stepping stone.
From Server Credentials to Cloud Access
Credentials found on the former server enabled access to Double Counter’s cloud environment. Once inside, attackers could abuse valid access details to move further through connected systems. That path is different from guessing a password at random, because the credentials already worked.
Cloud accounts often connect services that handle storage, databases, and other tools. A credential that appears limited may still open a path to a broader environment if permissions are too wide. The incident shows how an old machine can create risk beyond its own files.
Removing a server from daily use does not remove its internet access or stored secrets. Owners need to shut down old systems, revoke credentials, and check connected cloud permissions. The lasting lesson from this entry route is to remove access to retired systems, not merely stop using them.
What Did the Attackers Do With Their Access?
The attackers used Double Counter’s stolen bot token to post links under the bot’s identity in about 50 large Discord servers. A familiar bot name can make an unexpected post look more trustworthy than an unknown sender. That appearance can raise the chance that a member will open a link, though it does not show that every member clicked one.
The reported abuse involved both a hijacked bot identity and a stolen payment key. The two actions affected different parts of the service, and stored card numbers were not exposed.
- The stolen Discord bot token let attackers post links in about 50 large Discord servers.
- A stolen payment key led to 23 successful charges totaling $7,331, while 17 other charges were declined.
- Stored card numbers were not exposed, and refunds covered the reported fraudulent charges.
The successful charges totaled $7,331. Tellter SAS refunded $7,322 on the same day, then refunded the remaining $9 later. The separate set of 17 declined charges did not add to the successful total.
The bot token acts as a credential that lets software connect to Discord as a bot. If someone steals it, they may be able to use the bot’s identity until the token is revoked. A server member may see the expected name and icon, even when an attacker controls the post.
The payment activity involved a key that could authorize charges, not a file of customer card numbers. That difference matters when assessing whether a payment card itself needs replacement. The reported payment abuse involved a stolen key, not the exposure of stored card numbers.
Was Discord Itself Breached?
Discord said its own platform was not breached; the compromised systems belonged to the third-party bot provider, Double Counter. Discord’s third-party app API access did not include message content, passwords, or payment information. The affected boundary was the provider’s infrastructure.
Discord disabled new Double Counter installs while it assessed the incident, but that action did not remove bots already installed on servers. Each party had a different role in the response.
| Entity | Role in the incident | Documented response |
|---|---|---|
| Discord | Platform hosting the third-party app | Said its platform was not breached; disabled new installs October 12 |
| Double Counter | Affected bot provider | Restored service at 19:19 UTC October 4; reported containment steps |
| CNIL | France’s data-protection authority | Notified October 5 |
Double Counter reported removing the old server, revoking cloud access, rotating credentials, and moving databases behind private networking. It restored service at 19:19 UTC on October 4. The operator notified France’s data-protection authority, CNIL, on October 5.
Discord made its statement on October 12, 2026. Disabling new installs limited new use while the company assessed the situation. It did not erase the bot from servers where administrators had already added it.
Discord’s platform and Double Counter’s service are separate systems, even when the bot works inside Discord. The incident affected the service provider’s infrastructure, while Discord’s own statement ruled out a breach of its platform. A pause on new installs is not the same as removing an existing bot from a server.
How Can You Check If Your Email Was Exposed?
Have I Been Pwned lists 274,922 email addresses from the Double Counter breach, a smaller set than the roughly 1 million reportedly copied. The listing covers the public subset, not every address that may have been involved. A lookup has limits because it checks only the data indexed by the service.
A clean result cannot rule out inclusion in the broader email exposure. The public file held 275,000 unique email-and-username records, while the wider estimate covers around one million email addresses.
Can an Email Lookup Confirm the Full Exposure?
Have I Been Pwned added its Double Counter listing on October 7, 2026. It includes 274,922 affected email addresses from the public release. That count is close to, but not identical to, the rounded figure of 275,000 unique records in the released file.
A Discord leak checker can confirm whether an email appears in the dataset it has indexed. It cannot check records that were not included in that dataset. A clean result therefore says only that the address was not found in the listing, not that it was absent from every reported dataset.
The difference between the public file and the broader estimate is important. The public listing is a useful check for known records, but it does not cover every email address reportedly copied. Keep that scope in mind when reading a result.
Should You Download or Share the Public File?
You do not need to download a Double Counter leak to check your email address. Use Have I Been Pwned instead of seeking a copy of personal records. A file can include other people’s usernames and contact details, which they did not choose to publish.
Downloading or forwarding a data file can spread information beyond the original release. Searching for your own address through a checker gives you a safer way to see whether it appears in the indexed records. Avoid reposting lists or screenshots that expose someone else’s details.
A lookup is most useful when you treat it as one limited check, not as a full clearance. The listing’s count reflects the public subset, while the incident’s reported email exposure was broader. A clean lookup is useful, but it cannot prove that an address was absent from every dataset involved.
What Should Discord Users and Server Admins Do Now?
Discord users do not need to reset a password solely because of this incident, but they should secure accounts and watch for impersonation attempts. Double Counter did not hold Discord passwords, and the incident does not show that Discord passwords were exposed. Targeted messages may still use the event to trick users.
Change a reused or separately compromised password, and turn on two-factor authentication. Server owners should review the relevant audit-log window before deciding whether suspicious actions need removal.
Protect Your Personal Account
Be alert to messages that mention Discord, Double Counter, or Doogle, especially when they ask you to sign in or follow an unexpected link. A message using a familiar name can still come from an attacker. Check the sender and destination before you act.
Enable two-factor authentication to add a second check at sign-in. If you reused your Discord password elsewhere, change it on any service where the same password remains active. This incident alone does not mean your Discord password was exposed.
If a separate service reports a compromised password, replace it there and anywhere else you reused it. Keep access credentials out of public logs or code, and revoke and replace any key that appears in a public record. A general credential safety guide explains why exposed keys should be replaced rather than merely hidden.
What If You Downloaded the Double Counter Breach?
Do not open, forward, or repost a copy of the leaked file. Delete copies stored on your device and in cloud storage. Sharing the file could expose other people’s email addresses, usernames, or subscriber details.
Review Your Server’s Bot Activity
Server owners were advised to review Double Counter actions in audit logs from October 4, 2026, 12:00 to 16:30 UTC. Preserve useful evidence before removing suspicious actions from the logs. Use this checklist to review the server and its connected access:
- Inspect the October 4 audit-log window from 12:00 to 16:30 UTC.
- Remove suspicious bot actions or messages after preserving relevant evidence.
- Warn members about suspicious links posted under the bot’s name.
- Review and rotate credentials or webhooks connected to the bot dashboard.
- Watch official updates before reinstalling the bot or restoring its access.
A server’s audit log can help show which actions occurred and when. Keep a record of suspicious entries before changing them, especially if members report links or other unusual posts. Server owners should preserve relevant audit evidence before removing suspicious actions from their logs.
What Does Double Counter Collect During Verification?
Double Counter is a Discord verification bot that screens members using signals gathered during a server’s verification flow. It can help identify alternate accounts, raid patterns, and risky network signals. Those signals explain why the bot handles device and network data, but they do not mean every signal was exposed.
The normal verification process and the records treated as exposed in this incident are separate questions. A server chooses how the bot screens its members.
How the Double Counter Bot Works on Discord
When you join a server or click a verification button, the flow can capture device, browser, behavioral, and network signals. The bot compares those signals against millions of curated datapoints and applies more than 20 risk factors. The checks aim to flag patterns that may point to alternate accounts or unwanted activity.
Network signals can include an IP address and a rough estimate of location. A VPN can mask your public IP address from websites, but it does not make you anonymous. Before choosing a service, check its privacy terms, leak protection, and app features; free VPN plans may also limit data or features.
The signals a service can collect during normal use are not the same as a confirmed breach list. In this incident, certain records were treated as exposed or reportedly copied. That does not establish that every signal gathered in every verification flow appeared in the exposed data.
What Signals and Screening Modes Does It Use?
The bot’s checks can run at different points in the member’s path into a server. The server’s setup determines which screening mode applies. The available options include:
- Automatic checks when a user joins.
- Checks after a user clicks a button.
- A combination of join and button checks chosen by the server.
A join check can screen members as they arrive, while a button flow asks them to take an extra step. A server may combine both approaches to fit its entry rules. These choices affect when screening occurs, not what the breach figures mean.
Because the bot handles network and device signals, server owners should understand its permissions and data practices before adding it. Members can also consider what a server’s verification step asks them to do. Server owners should understand what a verification bot collects before granting it a continuing role in member screening.
Conclusion
The central takeaway is to treat the incident as a serious third-party exposure without confusing it with a breach of Discord’s core platform. A clean email lookup can help, but it cannot rule out every form of exposure. The scope matters when you judge what a result means.
Check your email against the public listing, then review any message or server activity that seems suspicious. Do not treat a familiar bot name as proof that a link is safe. Check your email against the public listing and keep a cautious eye on messages claiming to come from trusted bots.
FAQ
Were Discord passwords exposed in the Double Counter incident?
No, Double Counter did not hold Discord passwords, and the reported incident did not expose them. The affected records involved other account and network data. You should still change a password if you reused it on another service or that service reported a compromise. Use a different password for each account so one breach cannot unlock several services.
Does a clean Have I Been Pwned result mean my data was safe?
No, a clean result does not prove that all your data was safe. Have I Been Pwned lists 274,922 email addresses from the public release, while the broader reported email exposure was around one million. The checker can only match records in its listing. A result that finds no match is useful, but it cannot cover records outside that dataset.
Can I download the Double Counter leak to check my own records?
No, downloading the file is unnecessary for an email check. Use the public breach checker to see whether your address appears in its listing. Do not circulate a file that may contain other people’s contact details and usernames. A copy on your device or in cloud storage can spread by accident, so delete any copy you already have.
Is it safe to keep Double Counter installed on a Discord server?
Discord disabled new installs while assessing the incident, but server owners must decide what to do with bots already installed. Review the bot’s permissions and follow official updates before restoring access or continuing its use. A pause on new installs did not remove the bot from existing servers. You can remove it while you assess the risks and your server’s needs.
What should I do if Double Counter posted a link in my server?
Review the October 4, 2026 audit-log window from 12:00 to 16:30 UTC and check for suspicious bot actions. Preserve useful evidence, remove suspicious messages, and warn members not to follow questionable links. Check whether the bot’s name or token was used unexpectedly. Ask members to report any message they opened or information they entered.
Did the Double Counter breach expose every record tied to 28 million accounts?
No, the 28 million figure does not confirm that every record was downloaded or that 28 million individual people were verified as victims. The estimates describe overlapping datasets and records treated as exposed. Some categories reportedly were copied, while others were considered exposed through access to the systems. The figures cannot be added into a reliable person count.
What does the Double Counter bot do on Discord?
Double Counter screens members for alternate accounts and risky patterns during a server’s verification process. It can use device, browser, behavioral, and network signals, then compare them against curated datapoints. Server owners can choose checks that run when a user joins, after a button click, or through both steps. The bot’s normal data collection does not mean every signal was exposed.
