Identity · Privacy
Discord users’ data exposed in Double Counter bot breach
A breach at the Double Counter bot exposed data from about 28 million Discord accounts, including usernames, IP addresses and email addresses, according to The Verge.
Ross GrantUpdated 2 min read
The short version
A bot used by many Discord servers, Double Counter, was hacked. Attackers stole data about 28 million Discord users, including usernames, IP addresses, and email addresses. They also used the bot to post links in large servers and committed financial fraud. If you use Discord, be alert for suspicious messages and consider changing your password.
By the numbers
- 28 millionDiscord accounts affectedThe Verge
- 12GBAmount of data stolenThe Verge
- 1 millionEmail addresses exposedThe Verge
- 50Large Discord servers where attackers posted linksThe Verge
What happened?
Hackers breached the Double Counter bot used on Discord servers, copying about 12GB of data linked to roughly 28 million Discord accounts. The stolen data includes usernames, user IDs, IP addresses, location data, and around one million email addresses. Attackers also took control of the bot's Discord token and committed financial fraud using a stolen payment key. Only The Verge has reported this so far.
What was exposed
According to The Verge (opens in a new tab), attackers copied about 12GB of data from Double Counter, a bot used by Discord servers to manage privacy and user verification. The stolen data reportedly includes Discord usernames, user IDs, IP addresses, location data, and around one million email addresses. This information could be used to identify or target users.
How the attack unfolded
The attackers did more than just steal data. They also took control of Double Counter’s Discord token. A Discord token is a secret code that lets bots act as users or services within Discord. With this, the attackers posted links in about 50 large Discord servers. The attackers also used a stolen payment key to commit financial fraud on a separate account. The full details of how the attackers gained access have not been made public.
Who is affected
The breach affects users who interacted with servers using the Double Counter bot. The bot is popular for verifying users and preventing spam or alternate accounts. With 28 million accounts involved, this is a significant portion of the Discord community. The exposed information could put users at risk of phishing, spam, or targeted attacks.
What Discord and Double Counter have said
According to The Verge, Discord says it was not itself breached. The company has disabled new installs of the Double Counter bot to prevent further abuse. Double Counter has not released a detailed public statement about the breach or about what steps it is taking to secure user data. There is no confirmation yet from law enforcement or other independent sources.
What users should do
If you have used a Discord server with Double Counter, be alert for suspicious messages or emails. Do not click on unexpected links, even if they appear to come from a trusted server. Consider changing your Discord password and enabling two-factor authentication. If you reused your email and password elsewhere, change those passwords too. Watch for updates from Discord or Double Counter about the incident.
What happens next
It is not yet clear if the stolen data will be published or sold. Discord has acted to limit the bot’s reach, but users should remain cautious. Regulators in some countries may investigate, especially if personal data was exposed. Under laws like the UK GDPR, companies can face fines up to £17.5 million or 4% of annual turnover for serious breaches. However, there is no information yet about any regulatory action in this case.
Claimed vs confirmed
- Unconfirmed
Attackers stole data from 28 million Discord accounts via Double Counter.
Only The Verge has reported this claim; no confirmation from Discord or Double Counter.
- Confirmed
Discord itself was not breached.
Discord told The Verge it was not breached.
- Unconfirmed
Attackers used a stolen payment key to commit financial fraud.
The Verge reports this based on Double Counter's statements; no independent confirmation.
The impact
- Money
- There is no public estimate of financial losses. Under UK GDPR, fines for serious data breaches can reach £17.5 million or 4% of annual turnover, but no regulatory action has been announced.
- Reputation
- The breach may damage trust in Discord bots and third-party integrations. Discord acted quickly to disable new installs of the affected bot.
- Customers
- Users whose data was exposed may face phishing or scams. They should be cautious with unexpected messages and consider changing passwords.
Why it matters
Millions of Discord users may have had personal data exposed, putting them at risk of scams or targeted attacks. The breach shows how third-party bots can be a weak point in online communities.
How does it work?
The attackers gained access to Double Counter's systems, allowing them to copy user data and take control of the bot's Discord token. With the token, they could act as the bot in Discord servers, posting links and potentially spreading malicious content. The exact method used to breach the bot has not been disclosed.
Key points
- A breach at Double Counter exposed data from about 28 million Discord accounts.
- Stolen data includes usernames, user IDs, IP addresses, location data, and email addresses.
- Attackers used the bot's token to post links in large servers and committed financial fraud.
- Discord says it was not breached and has disabled new installs of the bot.
- Only one source has reported the incident so far; details may change.
Sources
The Verge
Reference
