A Discord moderation bot used to screen new members in more than 600,000 gaming communities has leaked data tied to an estimated 28 million accounts, making it one of the largest third-party breaches to hit the Discord ecosystem since the platform’s own 2023 support-desk incident. The bot, called Double Counter, disclosed on October 4, 2026, that an attacker had slipped in through a forgotten analytics server, pivoted into cloud infrastructure, and walked out with emails, IP addresses, and enough metadata to fuel months of phishing and account-takeover attempts against gamers who never signed up for Double Counter directly.
The breach lands at an awkward moment for gaming platform security. Over the past year, Discord itself weathered a support-vendor compromise, Rockstar Games disclosed fresh intrusions tied to stolen source code, and Denuvo has been subpoenaing Discord, Valve, and Reddit to unmask a serial cracker. Double Counter’s incident adds a new wrinkle: it is not the platform that failed, but a widely trusted add-on sitting on top of it, and that distinction matters for anyone trying to figure out whether their own data is at risk.
What Happened: Double Counter’s October 4 Breach Explained
Double Counter positions itself as an anti-alt-account tool, scanning new Discord members to flag throwaway accounts, raid bots, and ban evaders before they can cause trouble in a server. That role requires broad visibility into member data, which is precisely why its breach has such wide blast radius. According to the operator’s own incident report, the attacker did not go after Discord’s infrastructure at all. Instead, they found a leftover server from Double Counter’s previous hosting setup that was still online and running an outdated build of Metabase, an open-source analytics and dashboard tool.
Tellter, the operator of Double Counter, described the intrusion in blunt terms. “The attacker broke into a server from our previous hosting setup through a vulnerability in an analytics tool it was still running, then used credentials found on that server to reach our cloud infrastructure and adapted to each of our containment steps,” the operator said in the public incident report, as reported by Instant Gaming News. That last detail, that the intruder adjusted tactics as the response team tried to lock them out, points to a human operator rather than an automated script, and it explains why containment took hours rather than minutes.
Once inside, the attacker did more than copy a database. Tellter confirmed that “during the attack they took control of the bot’s Discord token, used it to post links to their own Discord server in about 50 large servers, copied part of one of our databases, and used a stolen payment key to commit financial fraud on a separate account,” a sequence that mirrors a growing pattern in supply-chain-style attacks against SaaS tools embedded in bigger platforms. Double Counter said it moved fast once it detected the fraud, stating it “revoked every payment-provider key at 17:14, rotated the credentials and secured the accounts” the same day the activity was spotted.
The Numbers: How Many Discord Gaming Accounts Were Exposed
The scale of the Double Counter breach sits in an unusual middle ground: it is not as deep as a full password dump, but it touches an enormous number of accounts across the gaming ecosystem. Reporting from GamesIndustry.biz, CyberSecurityNews, and Softonic, aggregated by security outlet Shattered, lays out the breakdown in granular terms. The attacker copied roughly 12 GB of data overall. Of that, account IDs and usernames tied to approximately 28 million accounts were partially copied, while around 27 million accounts had IP addresses and coarse geolocation data exposed alongside them.
User-agent hashes, essentially fingerprints of the browser or client used to access Discord, were copied for about 25 million accounts. The most sensitive subset is smaller but still significant: roughly 1 million full email addresses were taken outright, and the breach response later confirmed that around 275,000 email-and-username pairs were published by the attacker rather than simply held. That published subset is the one security researchers are telling gamers to check first, since it is already circulating and usable for credential-stuffing and targeted phishing right now.
| Data Category | Accounts/Records Affected | Exposure Type |
|---|---|---|
| Account IDs and usernames | ~28 million | Partially copied |
| IP addresses and geolocation | ~27 million | Partially copied |
| User-agent hashes | ~25 million | Partially copied |
| Full email addresses | ~1 million | Fully copied |
| Email and username pairs | ~275,000 | Published by attacker |
| Servers using Double Counter | 600,000+ | Service footprint affected |
| Large servers hit by token abuse | ~50 | Spam links posted |
| Fraudulent payment-key charges | $7,300+ | Refunded by Double Counter |
What makes this breach distinct from a typical gaming leak is the IP address exposure at that scale. Twenty-seven million IP addresses tied to usernames and coarse location data is enough to build a meaningful de-anonymization dataset, especially for Discord users who assumed a pseudonymous handle kept their real location private. Security researchers tracking the breach have flagged that combination, rather than the smaller email dataset, as the longer-term privacy risk for the gaming communities that relied on Double Counter.
Discord’s Response and Where the Line of Liability Falls
Discord moved quickly to draw a boundary between its own platform and the third-party bot sitting on top of it. A Discord spokesperson told Dexerto the company is “aware of a security incident involving Double Counter, a third-party app available on Discord,” and stressed that “while this was not a breach of Discord, we’ve disabled new installs of the app while we work with Double Counter to understand the full scope of the incident, and we’ll take further action as appropriate,” according to Dexerto’s reporting.
That framing is technically accurate and legally convenient, but it understates how deeply third-party bots are woven into the Discord experience for gaming communities. Anti-alt-account tools like Double Counter exist precisely because Discord’s native moderation tools are considered insufficient for servers with tens of thousands of members, which describes most large gaming communities, esports organizations, and game-launch Discord hubs. When a server owner installs a bot like Double Counter, they are implicitly granting it visibility into member IDs, join timestamps, and connection metadata for every person who passes through, often without those members ever being told which third-party service is processing their data.
This is the structural weakness the breach exposes: Discord’s permission model treats bots as trusted extensions of server administration, but the security posture of those bots is entirely outside Discord’s control until something goes wrong. Disabling new installs after the fact closes the barn door, but it does not retroactively protect the 28 million accounts whose data already left Double Counter’s systems weeks before the public disclosure.
Historical Context: A Pattern of Third-Party Breaches Hitting Gaming Platforms
Double Counter is not an isolated event. It fits a pattern that has repeated across the gaming sector throughout 2026, where the weakest link is rarely the flagship platform itself but the vendors, bots, and support tools orbiting it. Tech Insider has tracked several of these incidents this year, including the FBI’s arrest of a ShinyHunters suspect tied to a 3TB employee-data theft, the Oracle Health breach affecting nearly 20 million people, and the MCP credential leak that exposed 82,000 files tied to AI agent tooling. Each case involved a trusted intermediary, not the end platform, as the point of failure.
Gaming-specific third-party breaches follow the same logic Discord is dealing with now. The platform-level security at Discord, Steam, or PlayStation Network can be well-funded and mature, yet a single underfunded bot developer running a years-old Metabase instance can expose tens of millions of users in one incident. Similar dynamics played out in the Jurojin Poker hack, where vendor-side software, not the poker operator’s core platform, became the entry point for an attacker who exposed hole-card data for dozens of players.
Discord’s own history includes a comparable lesson. In 2023, the company disclosed that a compromised support-agent account at a third-party help desk vendor exposed a subset of user data, including government ID images submitted for age-verification appeals. That incident, like Double Counter’s, demonstrated that Discord’s core chat infrastructure can be secure while an adjacent vendor relationship becomes the actual point of failure. The recurrence of this exact failure mode three years later suggests the lesson has not fully propagated through the ecosystem of bot developers building on top of major gaming-adjacent platforms.
Competitive Landscape: How Discord Bot Security Stacks Up
Double Counter’s breach raises a fair question for server administrators running any of the dozens of popular moderation and anti-raid bots across the Discord ecosystem: how does this incident compare to the security track record of competing tools, and what should a server owner actually look for before granting a bot deep access to member data.
| Factor | Double Counter (Post-Breach) | Typical Established Moderation Bot |
|---|---|---|
| Legacy infrastructure exposure | Confirmed (outdated Metabase on old host) | Varies; audited vendors retire legacy hosts |
| Public incident transparency | Full public incident report published | Inconsistent across smaller bot developers |
| Token/credential compromise | Confirmed; bot token used to spam 50 servers | Risk present if token storage is unaudited |
| Payment data separation | Payment key was reachable from breached infra | Best practice isolates billing from bot runtime |
| Scale of communities affected | 600,000+ servers | Varies by bot popularity, often smaller |
| Disclosure speed | Public report within days of detection | Varies widely; some disclose only after press inquiry |
The one area where Double Counter arguably outperformed peers is disclosure. Publishing a detailed, timestamped incident report, including the exact containment action taken at 17:14, is more transparent than many smaller gaming-tool vendors manage after a breach. That transparency does not undo the exposure, but it does give the 28 million affected accounts and the server owners who installed the bot a clearer basis for deciding whether to keep using it, compared to vendors who stay silent or downplay scope.
Market and Industry Impact on Gaming Platform Trust
The immediate market impact of a bot breach like this is harder to quantify than a breach at a public company, since Double Counter is a privately operated service without a stock price to move. The real impact shows up in server administrator behavior and in how gaming communities assess third-party risk going forward. Large Discord servers tied to game launches, esports organizations, and streaming communities routinely run five to fifteen bots simultaneously for moderation, leveling, giveaways, and anti-raid protection. Each one represents a separate trust decision, and Double Counter’s breach is likely to push server owners toward auditing which bots actually need access to member IP data versus which ones are using it as an unnecessary default permission.
There is also a secondary effect on Discord’s own bot marketplace strategy. Disabling new installs of a specific bot after a breach is a reactive measure, and it puts pressure on Discord to consider whether its developer verification and security review process for high-permission bots needs to go further than it currently does. Bots that request message-content access, member-list visibility, and moderation permissions at the scale Double Counter operated at are functionally handling the same category of sensitive data Discord itself handles, without being held to Discord’s own security standards.
For the broader cybersecurity industry, the breach is another data point supporting a trend security vendors have been flagging for the past two years: attackers are increasingly targeting the software supply chain around major platforms rather than the platforms themselves, because the platforms have hardened their perimeters while the surrounding vendor ecosystem has not kept pace. Similar supply-chain logic underpinned the wave of law-firm data breaches tied to Holland & Knight and a string of vendor-side compromises across financial services earlier this year.
What Gaming Communities and Discord Users Should Do Now
For anyone active in a large Discord gaming server, the practical response to this breach is narrower than the headline numbers suggest, but it is still worth acting on. Security researchers recommend checking whether an email address appears in the published 275,000-record set using a breach-lookup service such as Have I Been Pwned, which indexes breach disclosures as they become publicly searchable. Because the exposed data includes IP addresses and user-agent fingerprints rather than passwords, a password reset alone does not fully address the risk; the bigger concern is targeted phishing that references real account details to appear more convincing.
- Check whether your email appears in the published Double Counter dataset through a breach-monitoring service.
- Enable two-factor authentication on your Discord account if it is not already active, since stolen emails and usernames are frequently reused in credential-stuffing attempts against other services.
- Be skeptical of unsolicited direct messages referencing server names, join dates, or IP-based location details, since attackers can use the leaked metadata to make phishing messages feel personalized.
- Review which bots have administrative or moderation permissions in servers you manage, and remove any that no longer serve an active purpose.
- Treat links posted by bots in large servers with suspicion for the next several weeks, since token-abuse incidents like this one can be followed by copycat spam campaigns exploiting user trust in bot-posted content.
Server administrators specifically should reassess the Double Counter integration and consider whether an alternative anti-alt-account tool, or Discord’s own native verification features, can cover the same use case with a smaller third-party footprint. Discord’s safety center outlines baseline account-protection steps for exactly this scenario and is a useful first stop for server owners, as documented on Discord’s safety resource hub.
Predictions: Where This Story Goes From Here
Based on how similar bot and vendor breaches have played out across the gaming sector this year, several outcomes look likely over the coming months.
- Discord will formalize stricter review for high-permission bots. Expect Discord to announce tighter verification requirements for bots requesting member-list, IP-adjacent, or moderation-level access, following the same pattern seen after its 2023 support-vendor incident.
- Copycat phishing campaigns will reference the leaked data within weeks. The 275,000 published email-username pairs are a ready-made target list; expect targeted phishing waves against affected gaming communities through November 2026.
- Other anti-alt-account and anti-raid bots will face security audits. Server administrators spooked by the scale of this breach are likely to start demanding security disclosures from competing bot developers before continuing to use similar tools.
- Legal scrutiny of bot developer liability will increase. As third-party bot breaches accumulate across gaming platforms, expect at least one jurisdiction to examine whether bot developers handling data at this scale should face the same breach-notification obligations as the platforms hosting them.
- Legacy infrastructure audits will become a standard incident-response recommendation. The root cause here, an old hosting server nobody decommissioned, is common enough across SaaS vendors that security firms are likely to cite this breach as a case study in infrastructure hygiene for the next year.
The Bigger Picture for Gaming Platform Security
What the Double Counter breach ultimately underscores is that the security of a gaming community is only as strong as the weakest bot sitting in its permission list. Discord has spent years building verification badges, developer policies, and permission scopes meant to let server owners trust third-party tools without fully vetting them individually. This breach shows the limits of that trust model when a popular bot’s own infrastructure hygiene falls behind its user base’s growth.
Twenty-eight million accounts is a number large enough to rival breaches at major consumer platforms, yet it happened to a tool most of those affected users never directly installed or even knew existed. That asymmetry, between the scale of exposure and the end users’ awareness of the service responsible for it, is likely to be the lasting lesson gaming communities take from this incident, and it is one that applies well beyond Discord to any platform that lets third-party developers build deep into its ecosystem.
Frequently Asked Questions
What is Double Counter and why did it have access to so much Discord data?
Double Counter is a third-party Discord bot used by server administrators to detect alt accounts and ban evaders. To function, it scans join data, account IDs, and connection metadata for every member of a server that installs it, which is why its breach affected data tied to an estimated 28 million accounts across more than 600,000 communities.
Was Discord itself hacked in this breach?
No. Discord confirmed to Dexerto that the incident involved a third-party app, not a breach of Discord’s own infrastructure, and the company disabled new installs of Double Counter while investigating the scope of the incident.
Were Discord passwords exposed in the Double Counter breach?
Public reporting on the incident documents exposure of account IDs, usernames, IP addresses, user-agent hashes, and roughly 1 million email addresses. It does not establish that Discord account passwords were part of the exposed data.
How can I check if my data was part of the Double Counter leak?
Breach-monitoring services such as Have I Been Pwned index publicly disclosed breach data as it becomes searchable. Checking an email address there is the most practical first step, since roughly 275,000 email-and-username pairs from this breach have already been published.
How did the attacker get into Double Counter’s systems?
According to the operator’s incident report, the attacker exploited a vulnerability in an outdated Metabase analytics installation running on a leftover server from Double Counter’s previous hosting setup, then used credentials found there to reach the company’s current cloud infrastructure.
Did the attacker steal money as well as data?
Yes. Double Counter said the attacker used a stolen payment key to commit fraud, resulting in more than $7,300 in unauthorized charges. The company said it revoked the affected keys and refunded the fraudulent charges the same day.
Should I remove Double Counter from my Discord server?
Security researchers generally recommend that server administrators reassess any bot involved in a confirmed breach, particularly one with this level of data access. Reviewing active bot permissions and removing unnecessary integrations is a reasonable precaution regardless of which specific bot a server continues to use.
Is this breach connected to other recent Discord or gaming security incidents?
It is not directly connected to incidents like the Rockstar Games source-code leaks or Denuvo’s subpoena efforts, but it fits a broader 2026 pattern of third-party vendors and bots becoming the entry point for attacks on gaming platforms that have otherwise hardened their own core infrastructure.