Discord protection bot Double Counter hit by breach exposing around 1 million email addresses

GamesIndustry.biz reports that Discord protection bot Double Counter suffered a deliberate, multi-stage breach on October 4, with attackers exploiting a vulnerability in a public analytics tool on a legacy server. The company says the intrusion lasted just under six hours and exposed a large set of Discord-linked data.

About 1 million email addresses were affected, while Discord IDs and usernames for roughly 28 million accounts and IP/coarse location data for about 27 million were treated as exposed. Have I Been Pwned says 274,900 email addresses and usernames have since appeared publicly, and paying-customer records also included names, countries, and postal codes.

The attackers reportedly stole a bot token, used it to post malicious links in around 50 large Discord servers, and made $7,316 in fraudulent charges on a separate payment account. Double Counter says it disabled the stolen credentials, rotated secrets, moved databases behind private networks, restored service the same day, and notified France’s CNIL on October 5.

Discord later said this was not a breach of Discord itself and disabled new installs of the app while it works with Double Counter to assess the scope. For server admins, the practical takeaway is to audit any Double Counter messages from October 4 and treat bot trust, token hygiene, and legacy tooling as active security risks.