You run a Discord server for a few thousand people. On October 4 the security bot you installed to keep strangers out posted an invitation to somebody else’s server, and your members clicked it, because the bot had earned their trust. That is the part of the Double Counter data breach that reached ordinary Discord users first — not a leaked spreadsheet, but a trusted bot speaking in an attacker’s voice for about three and a half hours.
Confirmation: confirmed by the company, in a published incident notice.
What happened in the Double Counter data breach
Double Counter is a verification bot that screens people joining a Discord server, and its own site says it serves more than 600,000 communities. The company, Tellter, published a timeline for incident INC-2026-10-04, so the sequence is on the record rather than inferred.
Probing started on October 3 at 04:37 UTC against a retired server from an older hosting setup. That machine still ran a self-hosted copy of Metabase, an analytics tool, reachable from the open internet. A flaw in it let the attacker forge an administrator session and read credentials stored on the host.
From there the attacker used two credentials that already existed: a cloud service-account key and an administrator’s saved session. So they created no new accounts, which is why the intrusion looked like ordinary activity. At 12:26 UTC they took the Discord bot token. At 13:30 the bot started posting links to the attacker’s own server in roughly 50 large communities, and the company invalidated the token nine minutes later.
Between 15:09 and 15:34 UTC the attacker copied about 12 GB out of the database tables. The company restored service with fresh credentials at 19:19 UTC and notified CNIL, the French data protection regulator.
How many email addresses the Double Counter data breach exposed, and why the count is disputed
Two figures are circulating, and they do not agree. Have I Been Pwned loaded the published corpus on October 7 and counted 274,922 unique email addresses alongside Discord usernames. Tellter’s own notice puts the exposure higher, at roughly 1.0 million accounts whose email addresses were copied.
Both can be true at once. The company is counting records it treats as taken; Have I Been Pwned counts distinct addresses in the subset somebody actually published. Until the gap closes, assume the larger number applies to you.
What the Double Counter data breach exposed, and what it is worth to someone
The notice lists approximate counts by data type, and each one has a different resale value.
- Discord user IDs and usernames, about 28 million accounts. This is the connective tissue. A username plus an email address lets somebody write to you about the exact server you are in.
- Email addresses, about 1 million accounts. The address itself is the delivery route for everything below.
- IP addresses and coarse geolocation, about 27 million accounts, plus city, country and user-agent hashes for about 25 million. Enough to make a fake alert read as though it knows where you live.
- Names, countries and postcodes for the smaller group of paying subscribers who pay through Stripe.
What the attacker did not take matters too, so it is worth stating plainly. Double Counter did not hold Discord passwords in the first place. Card details sit with the payment provider, and the behavioral database and the cold storage for roughly 58 million users came through untouched. Two customers also saw small fraudulent charges on a separate product, and the company refunded both.
What to do now
The useful actions here have almost nothing to do with us.
If you administer a server, delete any message Double Counter posted between 12:00 and 16:30 UTC on October 4 that invites people elsewhere, then read your audit log for bot actions in that window. If you are a member, do not join a server that an unexpected bot message advertised. Anyone who verified between 13:39 and 14:49 UTC without receiving a role should simply verify again.
Then treat your inbox as the exposed surface, because it is:
- Expect the follow-up phish dressed as Discord or as Double Counter. It will cite your username and your server, since the attacker holds both. Tellter has said it does not ask for passwords, tokens or payment by email or direct message.
- Turn on the strongest sign-in your Discord account offers, which means a passkey or an authenticator app rather than SMS codes.
- Use a password manager so the password on your Discord account exists nowhere else.
- Treat a link in an urgent message as the threat, and reach the service by typing its address yourself.
How OptMsg changes this exposure
We want to be careful here, because this breach happened at another company and nothing on our side would have stopped it.
What changes is the size of the aftermath on your side. Your OptMsg account has no password, so a password stolen from another site can’t open your inbox — there is no password on it to match. And because an email inbox is the reset-and-recovery route into most of your other accounts, an inbox that resists a stolen credential also keeps that credential away from the rest. Separately, mail from a sender you have not approved goes to Trash rather than your Inbox, and auto-deletes after 30 days. The phish built from this leak lands there.
Here is what that argument does not cover, stated honestly. It does nothing about a compromised device, a live phishing page you type your details into, or somebody holding your unlocked phone. The claim is narrow on purpose: a password that does not exist cannot be stolen or stuffed. If you want to read how we think about that, our security-first page lays it out.
Ready to put the master key behind something sturdier? Create your OptMsg account and pick your address while it is still free to choose.
Create Your Account
Your Inbox. Your Rules.
Frequently asked questions
Q: Was my Discord password exposed in the Double Counter data breach? A: No. Double Counter does not receive Discord passwords, so none were in the data. Nobody breached your Discord account itself; they breached a service you authorized inside it.
Q: How do I know whether my email address was in the leak? A: Search your address at Have I Been Pwned, which loaded the published corpus on October 7. Bear in mind that its 274,922 addresses cover the subset somebody published, while the company’s notice describes about a million.
Q: Should I remove Double Counter from my server? A: That is your call, and the company has since closed the affected database to the internet, rotated its secrets and moved its cache to a private network. The action that still matters is clearing the bogus invite messages from October 4 and reading your audit log.
Q: Why does a username-and-email pair matter if no password leaked? A: Because it makes a fake message convincing. Somebody who knows your handle and your server can write a Discord moderation notice that reads as real, and that message is now the attack.
Q: I verified during the incident and got no role. Is my account compromised? A: Probably not. The company advises anyone who verified between 13:39 and 14:49 UTC to verify again, because the company was replacing the bot token in that window.
Sources
- Double Counter (Tellter), incident notice INC-2026-10-04 — https://doublecounter.gg/blog/security-incident-october-2026
- Have I Been Pwned, Double Counter — 274,922 breached accounts, added October 7, 2026 — https://haveibeenpwned.com/Breach/DoubleCounter
- PC Guide, “Popular Discord server bot breach leaks 275,000 email addresses and usernames, including paying subscribers” — https://www.pcguide.com/news/popular-discord-server-bot-breach-leaks-275000-email-addresses-and-usernames-including-paying-subscribers/
Previous in Breach Breakdown: The ASOS Data Breach Sent the Scam Through the Brand's Own App
Next in Breach Breakdown: The Nippon Columbia Breach Turned 8.6 Million Karaoke Signups Into a Script
