A security breach has compromised the Discord protection bot Double Counter, resulting in the exposure of approximately 1 million email addresses

A data breach at Double Counter, a tool designed to protect Discord servers from unauthorized access and fake accounts, has compromised nearly one million email addresses, alongside Discord IDs and IP details for millions of users.

According to the company’s investigation report (cited by RPS), an intentional and complex attack took place on October 4. Attackers leveraged a flaw in an older analytics tool server to obtain cloud credentials, maintaining access for almost six hours.

The firm revealed that information, including Discord IDs and usernames for approximately 28 million users, as well as IP addresses and location data for around 27 million, is presumed compromised.

According to Have I Been Pwned, 274,900 emails and Discord usernames were posted publically. Data related to paying subscribers also featured names, nations, and zip codes.

The breach resulted in the theft of a bot token, which hackers used to disseminate harmful links across 50 large Discord communities, alongside incurring $7,316 in illegal charges on a separate account.

Double Counter has since blocked the compromised credentials, altered its security measures, and transferred databases to secured networks. Services were restored on October 4, with France's CNIL being informed the following day.

There is no required action for Discord users, but server managers are advised to remove any dubious messages from Double Counter dated October 4.

This incident has arisen amid efforts by Discord to restructure its age verification procedures. Initially announced to begin in March, the mandatory verification was postponed to late 2026 due to privacy issues.

Stanislav Vishnevskiy, the co-founder and CTO of Discord, admitted the company could have provided more clarity on its intentions and processes. The company has resumed verification only after implementing new methods not necessitating video selfies or ID checks.