adminThe Double Counter data breach exposed email addresses and other information linked to Discord accounts after attackers accessed the third-party service. Discord says its own systems were not breached, but it temporarily disabled new installs of the app while investigating with Double Counter.
Image credit: Discord
What happened in the Double Counter data breach?
Double Counter is a service used by Discord servers to help detect raids and alternative accounts. According to the company’s incident report, attackers carried out a deliberate, multi-stage attack on October 4, 2026. They exploited a vulnerability in a publicly accessible analytics tool on a legacy server and obtained cloud credentials. The attackers had access for just under six hours.
Double Counter said information associated with about 28 million accounts was partially copied. The potentially exposed data included:
- Discord IDs and usernames for about 28 million accounts
- IP addresses and approximate location data for about 27 million users
- About 1 million email addresses
The company is treating the affected account information as exposed. Have I Been Pwned reported that 274,900 email addresses and Discord usernames had been released publicly. These figures describe records identified as publicly released and should not be confused with the larger number of records Double Counter said may have been copied. Records belonging to paying customers also included names, countries and postal codes.
What Discord says was not affected
In an update on October 12 at 7:30 p.m., Discord said the incident involved Double Counter, a third-party app, rather than a breach of Discord’s systems. The company said the app’s API access did not include Discord message content, passwords or payment information. It also noted that the reported affected data included IP addresses associated with Discord IDs and usernames, email addresses and hashed browser information.
Discord disabled new installs of the app while it worked with Double Counter to assess the incident. This distinction matters: exposure of data held by a third-party service does not automatically mean that Discord account credentials or private messages were accessed.
What Discord users and server admins should do
Double Counter said Discord account holders do not need to take action on their accounts because of this incident. However, users can still take sensible precautions when an email address or IP-related information may have been exposed:
- Be cautious with unexpected messages, links and emails, especially those claiming to be security alerts.
- Do not share passwords or verification codes in response to a message.
- Use a unique password and enable two-factor authentication where available.
Server administrators were advised to remove suspicious Double Counter messages posted on October 4. The attackers reportedly used a stolen bot token to post malicious links in about 50 large Discord servers, so admins should review messages from that date and remove links that appear unsafe.
Response and service recovery
Double Counter said it disabled the stolen credentials, rotated its secrets and moved its databases to private networks. The service was restored on October 4, and the company notified France’s data protection authority, the CNIL, on October 5. The attackers also reportedly made $7,316 in fraudulent charges using a separate payment account.
The incident comes amid wider discussion about privacy and age verification on Discord. The company had announced plans for age verification to apply to all users starting in March, then postponed the rollout to the second half of 2026 following privacy concerns. Co-founder and chief technology officer Stanislav Vishnevskiy acknowledged that Discord should have explained its intentions and process in more detail. The company resumed verification efforts at the end of September after introducing alternative methods that do not require video selfies or identification documents.
Key takeaway about the Double Counter data breach
The Double Counter data breach affected information held by a third-party Discord app, not Discord’s own systems, according to Discord. While passwords, payment information and message content were not included in the app’s API access, exposed email addresses and account-related data can still be used in targeted scams. Users should treat unexpected links and requests with care, and server admins should check for suspicious messages posted on October 4.
