Double Counter Breach Exposes Data Tied to Up to 28 Million Discord Accounts

Double Counter, a third-party Discord bot that server owners use to block alt accounts, raids and VPN users, says an October 4 breach exposed data tied to up to 28 million Discord accounts. Discord says its own platform was not breached.

What was exposed, according to Double Counter. In an incident report published October 5, the bot's operator, Tellter, said the attacker copied about 12 GB from one of its databases between 15:09 and 15:34 UTC. Discord IDs and usernames for about 28 million accounts, and IP addresses with coarse geolocation for about 27 million, were partly copied. Because the company cannot tell exactly which of those records left, it treats all of them as exposed, which is why 28 million is an upper bound rather than a confirmed count.

User-agent hashes for about 25 million accounts and roughly 1 million email addresses were copied in full. According to the report, the email addresses belong to people who gave one to Double Counter or its Doogle service, such as dashboard users, customers and advertisers. The categories overlap, so the figures should not be added together.

Double Counter says about 15 million VPN detection logs were not copied, a separate cold-storage database was not affected, and it never held Discord passwords. Have I Been Pwned added the breach on October 7 after a dataset with about 275,000 unique email addresses and Discord usernames was posted publicly.

How the attack happened. The attacker got in through a retired server from Double Counter's old hosting setup that was still running a vulnerable analytics tool, then used credentials stored on it to reach the company's cloud. They were active in its cloud for 5 hours and 51 minutes (12:03 to 17:54 UTC). During that time they took the bot's Discord token and used it to post links to their own server in about 50 large Discord servers.

They also used a stolen payment key to run $7,316 in fraudulent charges on a separate payment account. Double Counter says only three cards were charged, one of its own and two customers', and that the customers were refunded. It says no stored card numbers were exposed and that it revoked every payment-provider key at 17:14. Service was restored at 19:19 UTC with new credentials.

Discord's response. In a statement to Dexerto, Discord said: “While this was not a breach of Discord, we've disabled new installs of the app while we work with Double Counter to understand the full scope of the incident.” Double Counter says it has reported the breach to France's data protection authority, the CNIL, and is pursuing the attackers in France and the United States.

What users should do. Double Counter says members do not need to change anything on their Discord accounts but should not join servers promoted in unexpected Double Counter messages. Server owners should delete Double Counter messages sent on October 4 between 12:00 and 16:30 UTC that invite people to another server, and check their audit logs for bot actions in that window. Anyone who gave Double Counter or Doogle an email address should watch for phishing.