Discord protection bot Double Counter hit by breach exposing around 1 million email addresses

Update: October 12, 7.30pm: Discord has now responded to the Double Counter data breach, saying it was not a breach of Discord and that it has disabled new installs of the app.

In a statement to GamesIndustry.biz , the company said: "We're aware of a security incident involving Double Counter, a third-party app available on Discord. While this was not a breach of Discord, we've disabled new installs of the app while we work with Double Counter to understand the full scope of the incident, and we'll take further action as appropriate."

According to Discord, Double Counter has publicly reported that the affected data included IP addresses collected by the app and associated with Discord IDs and usernames, email addresses and hashed browser information. Discord said the app's API access did not include message content, passwords or payment information.

Original story, October 7, 2026: Double Counter, a service that protects Discord servers from raids and alt accounts, has suffered a data breach that exposed about 1 million email addresses, as well as Discord IDs and IP addresses for millions more users.

In its incident report (via RPS ), the company described a "deliberate, multi-stage attack" on October 4. The attackers exploited a vulnerability in a publicly accessible analytics tool on a legacy server, which gave them access to cloud credentials. They had access for just under six hours.

Double Counter said Discord IDs and usernames for about 28 million accounts were partially copied, along with IP addresses and coarse location data for about 27 million. It is treating all of that data as exposed.

Breach tracker Have I Been Pwned says 274,900 email addresses and Discord usernames have since been released publicly. Records for paying customers also included names, countries, and postal codes.

The attackers also stole a bot token and used it to post malicious links in about 50 large Discord servers. They made $7,316 in fraudulent charges on a separate payment account.

Double Counter said it has disabled the stolen credentials, rotated its secrets, and moved its databases to private networks. Service was restored on October 4, and it notified France's data protection authority, the CNIL, on October 5.

Server members don't need to take any action on their Discord accounts, according to the company. It advised server administrators to delete any suspicious Double Counter messages from October 4.

The breach comes as Discord attempts to relaunch its age verification system. In February, Discord announced that age verification would be required for all users starting in March, but the rollout was postponed to the second half of 2026 due to privacy concerns.

Co-founder and chief technology officer Stanislav Vishnevskiy acknowledged that Discord "should have provided more detail about [its] intentions and how the process works" and the company only restarted its verification efforts at the end of last month after introducing alternative methods that do not require video selfies or ID.