Double Counter Breach Exposes Data of 28 Million Discord Accounts
On October 4th, Double Counter a verification and anti-alt account service for Discord communities suffered a six-hour breach after an attacker infiltrated its infrastructure. The incident exposed sensitive data tied to approximately 28 million Discord accounts, including usernames, IP addresses, coarse geolocation details (country, region, city, postal code, and ISP), user-agent hashes, and around 1 million email addresses. Additionally, 15 million VPN detection records containing IP addresses and user agents were compromised.
While Double Counter confirmed that passwords and stored payment card numbers were not exposed, the attacker managed to fraudulently charge $7,316 across three credit cards. The charges included escalating transactions ($1, $10, $100, and $1,000) on one of Double Counter’s own cards, as well as two smaller charges ($18 total) on customer cards, both of which were later refunded.
The breach originated when the attacker exploited a vulnerability in an abandoned server from Double Counter’s former OVH hosting environment. After probing the server from rotating VPN addresses on October 3rd, they gained access to an administrator’s credentials via a publicly exposed analytics tool. Using these credentials, the attacker accessed Double Counter’s cloud infrastructure, extracted a Discord bot token, and took control of the bot’s identity.
Once compromised, the bot began posting spam invitations to the attacker’s Discord server in around 50 large communities, including high-profile servers like "Steal a brainrot." Most of these messages were later removed by Double Counter or server moderators.
Double Counter stated that a separate cold-storage database containing 58 million user records and a behavioral data database remained unaffected, as they were stored outside the breached infrastructure. The company has since contained the attack and restored service. The exposed data particularly the combination of usernames, IP addresses, and geolocation could be valuable for tracking or profiling users across online platforms.
Source: https://cybernews.com/security/discord-user-data-breach/
Counter Culture Drinks - B Corp™ cybersecurity rating report: https://www.rankiteo.com/company/counterculturedrinks
"id": "COU1791463157",
"linkid": "counterculturedrinks",
"type": "Breach",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '28 million Discord accounts',
'industry': 'Cybersecurity, Discord Community '
'Management',
'name': 'Double Counter',
'type': 'Service Provider'}],
'attack_vector': 'Exploited vulnerability in abandoned server',
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '28 million Discord accounts, 15 '
'million VPN detection records',
'personally_identifiable_information': ['Usernames',
'IP addresses',
'Geolocation',
'Email addresses'],
'sensitivity_of_data': 'High (PII, behavioral data)',
'type_of_data_compromised': ['Usernames',
'IP addresses',
'Geolocation details',
'User-agent hashes',
'Email addresses',
'VPN detection records']},
'date_detected': '2023-10-04',
'description': 'On October 4th, Double Counter, a verification and anti-alt '
'account service for Discord communities, suffered a six-hour '
'breach after an attacker infiltrated its infrastructure. The '
'incident exposed sensitive data tied to approximately 28 '
'million Discord accounts, including usernames, IP addresses, '
'coarse geolocation details (country, region, city, postal '
'code, and ISP), user-agent hashes, and around 1 million email '
'addresses. Additionally, 15 million VPN detection records '
'containing IP addresses and user agents were compromised. The '
'attacker also fraudulently charged $7,316 across three credit '
'cards.',
'impact': {'brand_reputation_impact': 'High',
'data_compromised': '28 million Discord accounts, 15 million VPN '
'detection records',
'downtime': '6 hours',
'financial_loss': '$7,316',
'identity_theft_risk': 'High (IP addresses, geolocation, '
'usernames, email addresses)',
'operational_impact': 'Spam invitations posted in ~50 large '
'Discord communities',
'payment_information_risk': 'Low (no payment card numbers exposed, '
'but fraudulent charges occurred)',
'systems_affected': 'Discord bot, cloud infrastructure'},
'initial_access_broker': {'entry_point': 'Abandoned server from former OVH '
'hosting environment',
'high_value_targets': 'Administrator credentials, '
'Discord bot token',
'reconnaissance_period': 'October 3rd (probing from '
'rotating VPN addresses)'},
'investigation_status': 'Contained',
'motivation': 'Financial gain, data exfiltration',
'post_incident_analysis': {'corrective_actions': 'Secured infrastructure, '
'removed spam messages',
'root_causes': 'Exploited vulnerability in '
'abandoned server, publicly exposed '
'analytics tool'},
'ransomware': {'data_exfiltration': 'Yes'},
'references': [{'source': 'Incident Report'}],
'response': {'containment_measures': 'Attack contained, service restored',
'incident_response_plan_activated': 'Yes',
'recovery_measures': 'Restored service',
'remediation_measures': 'Removed spam messages, secured '
'infrastructure'},
'title': 'Double Counter Breach Exposes Data of 28 Million Discord Accounts',
'type': 'Data Breach',
'vulnerability_exploited': 'Publicly exposed analytics tool'}