A hacker hijacked Discord security bot Double Counter and used it to spam invites to their own server across around 50 communities.
That would be embarrassing for any bot, but Double Counter’s whole job is keeping alt accounts out, so it records the IP address of every member who verifies in its 600,000-plus communities.
That’s exactly the kind of data Discord users have grown protective of since Take-Two went to court to pry IP logs loose from a 100,000-member server last month, and this hacker didn’t ask anyone’s permission.
Double Counter hack exposed millions of Discord users’ IP addresses and emails
According to an incident report that Double Counter’s owner, Tellter, published on October 5, the hacker siphoned about 12GB from one of the bot’s databases in just 25 minutes.
That data was linked to roughly 28 million Discord accounts and included usernames, IP addresses, and rough locations down to the city and internet provider.
The hacker only got part of the IP records out before the team cut them off, but because Tellter can’t tell which ones left, it’s treating all of them as exposed, and around a million email addresses were copied in full.
Additionally, the hacker got in through an old server the company no longer used but had never switched off, which still ran a tool with a known security flaw. That forgotten machine held the keys to Double Counter’s live systems, so the hacker walked straight in and grabbed the password the bot uses to log into Discord, then grabbed the new one just two minutes after staff changed it.
They also found a payment key for Atis, another Tellter product, and charged a company card $7,316 in total, while two Atis customers got small charges that have since been refunded.
Tellter has reported the breach to France’s data watchdog and is filing a criminal complaint, so anyone who gave Double Counter’s services an email address should watch for phishing in the meantime.
It’s a familiar ache for Discord users, who watched around 70,000 people learn their government ID photos may have been exposed through a third-party vendor almost exactly a year ago.
Dexerto has reached out to Discord for comment on the breach.
I’m Abhishek Sharma, an author at TigerJek.com. I enjoy exploring games, testing different strategies, and turning what I learn into clear, useful guides. My goal is to help players understand the game better and improve without the usual confusion.
