Double Counter breach exposes 1 million Discord emails

Double Counter, a service that protects Discord servers from raids and alt accounts, reported a data breach on October 4, 2026. The incident began when attackers exploited a vulnerability in a publicly accessible analytics tool on a legacy server. This gave them access to cloud credentials, which they used for just under six hours. The breach exposed roughly 1 million email addresses, Discord IDs and usernames for about 28 million accounts, and IP addresses with coarse location data for about 27 million users. All of that information is being treated as compromised.

The breach also resulted in the theft of a bot token. Attackers posted malicious links in around 50 large Discord servers and made $7,316 in fraudulent charges on a separate payment account. Double Counter disabled the stolen credentials, rotated its secrets, and moved its databases to private networks. Service was restored later on October 4, and the company notified France’s data protection authority, the CNIL, on October 5.

According to Double Counter, server members do not need to take any action on their Discord accounts. The company advised administrators to delete any suspicious Double Counter messages from October 4. The breach tracker Have I Been Pwned reports that 274,900 email addresses and Discord usernames have since been released publicly. Records for paying customers also included names, countries, and postal codes.

The incident coincides with Discord’s efforts to relaunch its age verification system. In February, Discord announced that age verification would be required for all users starting in March, but the rollout was postponed to the second half of 2026 due to privacy concerns. Co‑founder and CTO Stanislav Vishnevskiy acknowledged that Discord "should have provided more detail about [its] intentions and how the process works" and the company only restarted its verification efforts at the end of last month after introducing alternative methods that do not require video selfies or ID.

Security experts warn that third‑party services like Double Counter are increasingly targeted because they often have broader access to user data than the platforms themselves. The breach highlights the need for robust monitoring of legacy infrastructure and prompt response when credentials are compromised. Users are encouraged to review their Discord server settings and consider enabling two‑factor authentication where available.