2026-10-30
Double Counter Discord bot data breach (about 28 million Discord IDs, 1 million emails): what leaked and what members and server admins should do
Tellter SAS, the operator of the Discord verification bot Double Counter, published an incident report on October 5, 2026 (version 2.0 on October 21). It says an attacker got in on October 4 through a publicly reachable Metabase analytics tool on a retired server at a hosting provider, then used two credentials for its cloud that were stored on that same server. About 28 million Discord user IDs and usernames, 27 million IP addresses with coarse location, 25 million hashed device details and 1.0 million email addresses were affected, with partial copying for the first two categories. About 5,000 customer records of the operator's payment products were also copied. Discord passwords were never received by the bot and full card numbers are not affected. The attacker also used the bot's token to post invitations to another Discord server in about 50 large servers. The operator notified the French data protection authority on October 5 and began emailing about 1 million people on October 21. This site's take: members do not need to change their Discord account, but should expect messages that use their ID, email and IP address, and server admins should delete invitation posts made on October 4.