Ever clicked “verify” to get into a Discord server? Your IP address could be among the records exposed in this discord data breach. Discord’s own systems were not hacked, but an attacker compromised Double Counter on October 4, 2026, exposing records associated with roughly 28 million accounts, according to Tellter’s estimates.
The stolen information included usernames, IP data and around one million email addresses. Your Discord password and full card number were not exposed. Here’s what you need to know before deciding what to do next.
| Detail | What we know |
|---|---|
| Date of attack | October 4, 2026, with reported attacker activity lasting about 5 hours and 51 minutes |
| Who was breached | Double Counter, operated by Tellter SAS |
| Accounts with IDs and usernames exposed | Approximately 28 million |
| IP addresses and rough location | Records associated with approximately 27 million accounts |
| Email addresses | Around one million copied, with roughly 275,000 represented in the published data recorded by Have I Been Pwned |
| Passwords | Not exposed |
| Fraudulent charges | $7,316 charged to a company card and $18 charged to two customers, later refunded |
| Discord’s response | New installations of Double Counter suspended |
What Happened in the Double Counter Breach
Let’s backtrack a little. According to Tellter, the attacker entered through an old OVH server running an internet-accessible, vulnerable Metabase analytics tool. Credentials left there allowed access to active cloud infrastructure, where the attacker obtained the bot’s token and copied about 12 GB of database information.
That token let the attacker send server invitations through Double Counter. Tellter notified France’s privacy regulator, CNIL, on October 5 and said it was filing a criminal complaint. The timeline shows how the intrusion developed.
A Timeline of October 3 and 4
| Time (UTC) | What happened |
|---|---|
| October 3, 04:37 | Probing of the old server began |
| October 4, 00:47 | The attacker gained entry through Metabase |
| October 4, 12:26 | The attacker obtained Double Counter’s bot token |
| October 4, 13:30 | Unwanted server invitations started appearing |
| October 4, 15:09-15:34 | Approximately 12 GB of database information was copied |
| October 4, 17:11 | Fraudulent payment activity began |
| October 4, 19:19 | Tellter brought the service back online using replacement credentials |
What Data the Discord Data Breach Exposed
The headline figure needs some care. Some tables were copied completely, while others were only partly taken, and Tellter cannot identify every affected record. To understand what that means for you, separate the information treated as exposed from the databases the attacker did not reach.
| Data type | Approx. accounts | Copied or not |
|---|---|---|
| Discord IDs and usernames | 28 million | Partly copied, with the full group treated as exposed |
| IP addresses and coarse location information | 27 million | Partly copied, with the full group treated as exposed |
| User-agent hashes, city and country | 25 million | Copied |
| Email addresses | One million unique addresses | Copied |
| VPN detection logs | 15 million records | Not copied |
| Separate cold-storage database | 58 million users, including around 800,000 emails | Not accessed |
| Behavioural database | No count provided | Not affected |
| Discord passwords | None | Never available to Double Counter |
| Stored card details | No count provided | Held by the payment provider and not exposed |
| Names, countries and postcodes | A small number of paying subscribers | Included in the published material recorded by Have I Been Pwned |
You see, a username becomes more revealing when it is tied to an IP address, city and internet provider. Those details could help someone profile you or connect your activity across communities, creating privacy and doxxing concerns.
Why do you keep seeing both 275,000 and one million emails? Have I Been Pwned covers the published portion it received. Tellter’s larger estimate describes the email data copied during the attack.
Is Your Discord Account Affected
You did not need to buy anything from Double Counter to fall within the affected group. Simply completing its verification process could have placed your information in its databases. Check whether any of these situations applies to you.
- Verification users. You completed Double Counter verification in any Discord server.
- Doogle users. You used Tellter’s related moderator lookup service, which accounted for most of the copied email addresses.
- Dashboard and business contacts. You used the dashboard or supplied contact information as a server manager, customer or advertiser.
- Paying subscribers. A small number had their names, countries and postcodes included in the published data.
You can search your email address on Have I Been Pwned, which added Double Counter on October 7. Remember, its published dataset covers fewer emails than Tellter says were stolen. Tellter has not described a process for notifying each affected person individually.
What to Do Right Now
Tellter says ordinary members do not need to alter their accounts because of this incident. Even so, exposed contact details give you a reason to be careful with messages that arrive afterwards. Start with these checks.
- Check your email on Have I Been Pwned. Look for the Double Counter entry, keeping the smaller published dataset in mind.
- Ignore unexpected invitations. Do not join a server because an unusual Double Counter message tells you to. The attacker used the stolen bot token to distribute invitations.
- Watch for impersonation. Tellter says it never requests your password, account token or payment through email or direct messages. Treat requests for those details as suspicious.
- Strengthen your login protection. Enable two-factor authentication and use a strong password reserved for Discord. These are sensible precautions, rather than changes required because your password leaked.
- Repeat an incomplete verification. If you verified on October 4 between 13:39 and 14:49 UTC without receiving your role, Tellter recommends trying again.
- Review payment activity. If you paid Tellter or Atis, check your statements. Tellter reported charges against two customers, refunded both, and said other customers were unaffected.
- Use Discord’s support channels for Discord billing problems. Report account compromise through its hacked-account form and request refunds through billing support. Discord warns that a direct bank chargeback can result in account suspension during its investigation.
How to Remove a Bot From Your Discord Account
Want to withdraw an app’s access? You can remove an account authorisation or kick a bot from a server you manage. Choose the procedure that matches where the app is connected.
On Desktop or Browser
- Open the gear icon menu using the cogwheel near the lower-left corner.
- Select Authorized Apps.
- Find the app you want to remove and select Deauthorize.
On Mobile
- Tap your avatar at the bottom-right.
- Tap the cogwheel at the top-right to open the gear icon menu.
- Open Authorized Apps and tap the x beside the app.
Kicking a Bot From a Server You Run
- Open your server’s Members list.
- Right-click the bot’s name.
- Select Kick. You need to own the server or have Manage Server permission.
Removing an authorisation ends future access through that permission. It does not erase information the bot collected earlier. To request deletion, use Double Counter’s /privacy command or its contact form.
Steps for Server Owners and Moderators
If you run a server, the immediate job is to check what Double Counter posted during the attack. Tellter says around 50 large servers received invitations distributed through the stolen bot token. Start with the messages and permissions you can review yourself.
- Remove the attacker’s invitations. Tellter recommends deleting Double Counter messages inviting members to another server that appeared on October 4 between 12:00 and 16:30 UTC. Those invitations could look like ordinary bot messages because the attacker was using the bot’s credentials.
- Review your audit log. Check Double Counter’s recorded actions during that same period. Tellter specifically recommends this review, so do not assume that deleting the visible invitations finishes the job.
- Check the bot’s permissions. Discord apps can receive rights to create channels, remove messages and change roles. Keep the permissions necessary for the work you expect the bot to perform.
- Decide whether to retain it. Tellter reports that service resumed after credentials were replaced. Discord has paused new installations, but it has not explained whether existing installations will face restrictions.
- Warn your members. Explain that unexpected invitations appearing to come from Double Counter were part of the attack. Tellter says it does not request passwords, tokens or payments through email or direct messages.
You see, a familiar bot name does not make every message trustworthy. In this incident, the stolen token allowed messages to reach Discord without going through Double Counter’s own systems.
How This Differs From Discord’s 2025 Support Vendor Breach
Another Discord-related breach? Yes, but the affected service and records were different. The 2025 incident involved a customer-support provider, while this attack targeted a verification bot used by server members. Here is how the two incidents compare.
| Detail | Double Counter, October 2026 | Support vendor, September-October 2025 |
|---|---|---|
| Who was breached | Tellter’s Double Counter infrastructure | A third-party provider handling Discord support |
| Number affected | Approximately 28 million accounts with IDs and usernames treated as exposed | No confirmed overall total, with around 70,000 users possibly having ID photos exposed |
| ID photos | No government ID image exposure reported | Government ID photos associated with some age-related appeals |
| Card data | Stored card details were not exposed, though a stolen payment key enabled fraudulent charges | Last four card digits and purchase history, without full numbers or CVV |
| IP addresses | Records associated with approximately 27 million accounts treated as exposed | Included among the affected support information |
| Passwords | Not exposed | Not exposed |
| Who was affected | Verification users, Doogle users and certain dashboard or business contacts | Users with information in the affected support records |
Neither incident was described as an intrusion into Discord’s own servers. That distinction matters, but it does not make the exposed information harmless.
The difference for you is how your data reached the third party. With Double Counter, completing a server verification could place your IP information in its database. You did not need to contact Discord support.
Why a Double Counter Breach Raises Questions About Bot Permissions
A verification bot can collect information outside Discord while helping manage access inside it. Double Counter records your IP address when you complete its web verification to identify alternate accounts. To judge the privacy implications, you need to consider that collection alongside the permissions Discord grants.
Discord says Double Counter’s API access did not include your message content, password or payment information. Yet the bot’s separate databases contained usernames, IP addresses and approximate location details. Those records could help someone connect accounts across communities or build a profile of your activity.
That is worth your attention if you stream, keep different online identities separate, or have concerns about stalking and doxxing. The exposed location information was coarse, including fields such as country, region, city, postal code and internet provider. It should not be confused with a confirmed street address.
What about Discord’s app verification? Apps must undergo checks, including developer identity verification, before they can join more than 100 servers. Double Counter’s incident still began through a vulnerable analytics tool on Tellter’s old server.
Tellter has since reported changes including credential replacement, a dedicated store for bot tokens and webhook secrets, and removal of an account with excessive privileges. These describe its response to the attack. Discord’s final decision about the app remains unresolved.
What We Still Don’t Know
Tellter says it contained the incident, but the investigation has not answered every question. Its report is due to receive another update when that investigation finishes. Until then, keep these gaps separate from confirmed findings.
- Attacker identity. Reports so far do not identify who carried out the intrusion.
- Exact Metabase flaw. Neither the software version nor a specific CVE has been named.
- Existing installations. Discord has not clarified whether bots already installed on servers will be restricted.
- Installation restart. There is no announced date for allowing new Double Counter installations again.
- Further publication. We do not know whether more of the roughly one million copied email addresses will become public.
- Final findings. Tellter has not yet published the concluding investigation update described in its report.
The published email count is therefore only one measure of the incident. It does not establish the full amount stolen.
What to Watch Next
You do not have to wait for every unanswered question before taking useful action. Check your email against Have I Been Pwned, ignore suspicious invitations and review app access through the gear icon menu. If you manage a server, add the message and audit-log checks to that list.
Next, watch for Tellter’s final report, any response from CNIL and Discord’s decision on Double Counter installations. Tellter notified the French regulator on October 5, but no resulting enforcement decision has been reported.
Keep an eye on messages using your leaked details to sound convincing, too. Doogle users, advertisers and API customers were specifically warned to expect phishing. You can keep using Discord while making careful decisions about the apps you authorise and the requests you trust.
FAQs
No, this incident involved Double Counter’s infrastructure rather than Discord’s own servers. Your information could still be affected if the bot collected it during verification or another interaction with Tellter’s services.
The exposed records do not include your Discord password, so they do not by themselves provide that login credential. Someone could use your contact details to make phishing more convincing. Be cautious with messages asking you to supply passwords or account tokens.
You can search your email address on Have I Been Pwned and look for its Double Counter entry. That entry covers roughly 275,000 published email addresses. A clear result cannot rule out inclusion in the larger email dataset Tellter says was copied.
You can review each bot’s data collection and permissions before deciding whether to keep it. This incident concerns Double Counter specifically, and Discord has suspended new installations of that app. Tellter recommends checking its messages and audit-log activity in affected servers.
No, withdrawing authorisation stops future access through that permission without deleting previously collected information. For Double Counter, you can request deletion through its /privacy command or contact form. Removing access and requesting deletion are separate actions.
No individual notification process from Discord has been reported for this incident. Double Counter has not explained how it would notify every affected user either. You can check the published email data yourself instead of waiting for a notice.
