Double Counter, a service that protects Discord servers from raids and alt accounts, has suffered a data breach that exposed about 1 million email addresses, as well as Discord IDs and IP addresses for millions more users.
In its incident report (via RPS), the company described a “deliberate, multi-stage attack” on October 4. The attackers exploited a vulnerability in a publicly accessible analytics tool on a legacy server, which gave them access to cloud credentials. They had access for just under six hours.
Double Counter said Discord IDs and usernames for about 28 million accounts were partially copied, along with IP addresses and coarse location data for about 27 million. It is treating all of that data as exposed.
Breach tracker Have I Been Pwned says 274,900 email addresses and Discord usernames have since been released publicly. Records for paying customers also included names, countries, and postal codes.
The attackers also stole a bot token and used it to post malicious links in about 50 large Discord servers. They made $7,316 in fraudulent charges on a separate payment account.
Double Counter said it has disabled the stolen credentials, rotated its secrets, and moved its databases to private networks. Service was restored on October 4, and it notified France’s data protection authority, the CNIL, on October 5.
Server members don’t need to take any action on their Discord accounts, according to the company. It advised server administrators to delete any suspicious Double Counter messages from October 4.
The breach comes as Discord attempts to relaunch its age verification system. In February, Discord announced that age verification would be required for all users starting in March, but the rollout was postponed to the second half of 2026 due to privacy concerns.
Co-founder and chief technology officer Stanislav Vishnevskiy acknowledged that Discord “should have provided more detail about [its] intentions and how the process works” and the company only restarted its verification efforts at the end of last month after introducing alternative methods that do not require video selfies or ID.