For: Discord users who verified through the Double Counter bot, administrators of servers that use it, and people who run self-hosted analytics tools. This article is based on the operator's own report and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 30, 2026Not yet known
- Exact number of people affected
- Which published data copies have been removed
- Result of the data protection authority review
- Result of the criminal complaint
The operator's report is dated October 5 and was updated to version 2.0 on October 21. It says the incident is contained, service was restored with new credentials, and removal of published copies of the data has been requested. As of October 30 we found no later version.
What to do today
Members: do not act on messages that use your Discord ID, email or IP address
The leaked items let someone write a message that looks specific to you, for example "your Double Counter account is affected" with a link. The operator says it never asks for passwords, tokens, or payment by email or private message. If you receive an email about the incident, do not click the link; open the operator's website yourself (see What is phishing?).
You do not need to change your Discord password because of this incident. A second login factor on Discord is still worth having.
Members: re-verify only if you were affected in the verification window
The operator says that if you verified between 13:39 and 14:49 UTC on October 4 and did not receive your role, you should verify again. Otherwise no action is needed.
Server admins: delete the invitation posts and review your audit log
The operator says invitations to the attacker's server were posted as if from Double Counter in about 50 large servers, starting at 13:30 UTC on October 4. Delete any Double Counter message from October 4, 12:00 to 16:30 UTC, that invites people to another server, and check your audit log for Double Counter actions in that window.
Bot, advertiser and API customers: treat payment-related messages as fake
The operator says it is contacting affected customers of its payment products itself. Customers should be wary of fake payment or refund messages. A card brand, expiry date and last four digits together with a name and billing address are enough for a convincing fake invoice.
If you have your own Discord bot, rotate its token
The operator says the attacker read the bot token from a container and used it to act as the bot. This is a general reminder, not a claim about your bot: store tokens in a secrets store rather than in plain files, restrict the permissions you give the bot, and reset the token whenever you suspect exposure.
What happened (per the operator's report)
The following is based on the incident report published by Tellter SAS, the operator of Double Counter, on October 5, 2026 and updated to version 2.0 on October 21 (checked October 30). Times are UTC.
October 3, 05:28
Probing of the operator's systems began from rotating VPN addresses.October 4, 00:47
The attacker logged into a retired server at a hosting provider, through a publicly reachable self-hosted Metabase instance on that server.October 4, 12:03 to 17:54
Activity inside the cloud project, 5 hours 51 minutes in total. The operator says the attacker exported a database (5.0 GB, which the report says was never downloaded), read the bot token, copied about 12 GB, and changed the database administrator password.October 4, 13:30
Invitations to the attacker's server begin to appear in about 50 large Discord servers.October 4, 17:54 and 19:19
The last recorded action in the cloud infrastructure, and then service restored with new credentials.October 5
Report published. The French data protection authority (CNIL) was notified.October 21
Version 2.0 of the report. Notification emails to about 1 million people began under GDPR, and a criminal complaint was filed with the Paris public prosecutor.
- Discord IDs and usernames
- About 28 million records, partly copied and treated as exposed
- IP addresses and coarse location
- About 27 million records, partly copied and treated as exposed
- Device details
- About 25 million records of hashed user-agent, city and country, used for alt-account detection. Copied
- Email addresses
- About 1.0 million, de-duplicated. Copied
- VPN detection logs
- About 15 million. The operator says these were not copied
- Payment product customers
- About 5,000 records of name, email, Discord ID, billing address, plan, payment history, card brand, expiry date and last four digits. Copied, partly published
- Not affected
- Discord passwords, which the bot never received. Full card numbers and security codes, which only the payment provider holds
- Actions taken
- Deleted the stolen credential, revoked administrator sessions, removed the attacker's access key, shut down the legacy server, reset the bot token, deleted ten exposed webhooks, closed the database to the internet, rotated credentials, signed staff out and turned on monitoring
Retired server, internet-reachable Metabase
↓→
Forged administrator session
Two cloud credentials found on that server (admin key, saved session)
↓→
Database exported, about 12 GB copied
Bot token read from a container
↓→
Bot used to post invitations in about 50 large servers
What is known and what is not
Status as of October 30, 2026. When the operator publishes more, we will update the status column.
| Item | What the operator says | Status |
|---|---|---|
| Discord IDs and usernames | About 28 million; partly copied | Treated as exposed (operator) |
| IP addresses and coarse location | About 27 million; partly copied | Treated as exposed (operator) |
| Hashed device details | About 25 million | Leak confirmed (operator) |
| Email addresses | About 1.0 million, de-duplicated | Leak confirmed (operator) |
| VPN detection logs | About 15 million | Not copied (operator) |
| Payment product customer records | About 5,000; partly published | Leak confirmed (operator) |
| Discord passwords | Never received by the bot | Not affected (operator) |
| Full card numbers and security codes | Held only by the payment provider | Not affected (operator) |
| Abuse of the bot | Invitation posts in about 50 large servers; substantially all deleted | Confirmed abuse (operator) |
| Card charges on a separate Tellter product | 23 of 40 attempted charges succeeded for US$7,331; refunded | Confirmed (operator) |
| Entry point | Publicly reachable self-hosted Metabase on a retired server; forged administrator session | Confirmed (operator); CVE not named |
| Backdoors left behind | None found in an audit of 14 cloud projects | No backdoor found (operator) |
| Regulator and law enforcement | CNIL notified October 5; criminal complaint filed October 21 | Confirmed (operator) |
| Removal of published copies | Requested | Under way |
How to read this: 'partly copied' is the operator's wording
The operator treats the Discord ID and IP address records as exposed even though only part was copied. The counts are approximate, in the operator's words. This site does not add the categories together, because the same person may appear in several of them.
What these items can be used for
In general, these combinations can be misused as described. This does not mean it has happened in this case.
- Discord ID and username: lets someone message you directly or impersonate a bot or a moderator in a server you share
- IP address and coarse location: tells someone roughly where you are and which internet provider you use; it is not a street address, but it makes a threat or a "we know where you are" message sound real
- Email address with a Discord ID: links your Discord identity to your email, which can be used to target you outside Discord
- Billing details of payment product customers: a name, billing address and card tail are enough for a believable refund or invoice scam
For people who run analytics tools and bots
The operator says the entry point was a self-hosted analytics tool on a server it had retired but not removed from the internet, and that the attacker then used two cloud credentials that were stored on that same server. This follows other breaches through the same kind of tool; see our article on Metabase vulnerability breaches. The operator did not name a CVE for this incident, so we do not link it to that one.
Two checks follow from the operator's own account:
- Retired systems: list every server and tool you still pay for or still have DNS for, and delete the ones you no longer use. Check from outside your network which of your analytics, dashboard and admin tools answer on the internet.
- Credentials that can do everything: the operator reports the attacker used a service-account key with administrator rights and a saved administrator session. Give service accounts only the permissions they need, set short lifetimes for saved sessions, and alert on a new SSH key or a first-time login to your cloud project.
For Discord bots specifically, the token is the bot's identity. Anything that can read it can act as the bot in every server where the bot has permissions, so keep the permissions you grant the bot as narrow as possible.
Sources (public record)
The facts in this article are based on the public information below. We do not speculate on undisclosed techniques or on who was responsible.
- Tellter SAS (operator of Double Counter), "Security incident INC-2026-10-04" incident report (October 5, 2026; version 2.0, October 21, 2026) — doublecounter.gg
Update history
2026-10-30: First version, based on the operator's report version 2.0 (October 21), checked October 30. We will update this article when the operator publishes a new version.
Read next
- Same kind of entry point: Metabase vulnerability breaches
- Scams: What is phishing? / Multi-factor authentication guide
- Passwords: Password manager guide
- Other 2026 incidents: Data breaches and cyberattacks in 2026