--- title: Double Counter Discord bot breach exposes about 1... description: Double Counter, a Discord anti-raid and anti-alt-account protection service, suffered a breach on October 4 after attackers exploited a vulnerability in... canonical: https://daily.dev/posts/double-counter-discord-bot-breach-exposes-about-1-million-email-addresses-iyyh5haou twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Double Counter Discord bot breach exposes about 1 million email addresses | daily.dev og:description: Double Counter, a Discord anti-raid and anti-alt-account protection service, suffered a breach on October 4 after attackers exploited a vulnerability in... og:url: https://daily.dev/posts/double-counter-discord-bot-breach-exposes-about-1-million-email-addresses-iyyh5haou og:image: https://api.daily.dev/og/posts/iYYH5hAOu.png og:image:alt: Double Counter Discord bot breach exposes about 1 million email addresses og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Double Counter Discord bot breach exposes about 1 million email addresses **[Collections](https://daily.dev/sources/collections)** · 1 min read · 0 upvotes · 0 comments ## Summary Double Counter, a Discord anti-raid and anti-alt-account protection service, suffered a breach on October 4 after attackers exploited a vulnerability in Metabase, a publicly accessible analytics tool on a legacy server. The attackers gained cloud credentials for nearly six hours, exposing about 1 million email addresses and Discord IDs/IP addresses for tens of millions more accounts. They also stole a bot token to post malicious links in roughly 50 large servers and ran over $7,000 in fraudulent charges. Double Counter has rotated secrets, moved databases to private networks, and notified France's CNIL. Have I Been Pwned confirms 274,900 email addresses and usernames were publicly released. ## Content Double Counter, a service that provides anti-raid and anti-alt-account protection for Discord servers, was breached on October 4. The attack was deliberate and happened in several stages. The attackers exploited a vulnerability in Metabase, a publicly accessible analytics tool running on a legacy server. That gave them cloud credentials, and they kept access for just under six hours. The exposed data includes roughly 1 million email addresses. Discord IDs and IP addresses were also exposed for tens of millions more accounts. The attackers did more than copy data. They stole a bot token and used it to post malicious links in about 50 large Discord servers. They also ran over $7,000 in fraudulent payment charges. Double Counter says it has disabled the stolen credentials, rotated its secrets, and moved its databases onto private networks. It has also notified France's data protection regulator, the CNIL. Have I Been Pwned has added the breach and confirms that 274,900 email addresses and usernames have been publicly released. Troy Hunt shared the HIBP notice, which attributes the breach to the Metabase vulnerability. If you ran Double Counter on a server, it's worth checking your address there. ## Questions this post answers ### How did attackers breach the Double Counter Discord bot service? Attackers exploited a vulnerability in Metabase, a publicly accessible analytics tool running on a legacy server, to obtain cloud credentials. They held access for just under six hours on October 4, during which they exfiltrated data, stole a bot token to post malicious links in about 50 large Discord servers, and made over $7,000 in fraudulent payment charges. _Teams running Metabase or similar analytics tools can track emerging vulnerability disclosures on daily.dev._ ### How many accounts were affected by the Double Counter Discord bot data breach? Roughly 1 million email addresses were exposed, along with Discord IDs and IP addresses for tens of millions more accounts. Have I Been Pwned confirmed that 274,900 email addresses and usernames were publicly released as part of the breach, which was attributed to the Metabase vulnerability. _Anyone who used a Discord moderation bot can follow breach disclosures like this one on daily.dev._ ### What did Double Counter do after its breach to prevent further damage? Double Counter disabled the stolen credentials, rotated its secrets, and moved its databases onto private networks. It also notified France's data protection regulator, the CNIL, as part of its incident response following the Metabase-related breach. _Engineers building incident response playbooks can compare real breach remediation steps on daily.dev._ ## Similar posts on daily.dev - [BreachForums Breach Exposes Names of 324K Cybercriminals, Upends the Threat Intel Game](https://daily.dev/posts/breachforums-breach-exposes-names-of-324k-cybercriminals-upends-the-threat-intel-game-gniyjeusk) · Security Boulevard · 0 upvotes · 0 comments - [Over 543,000 valid credentials exposed in public GitHub repositories](https://daily.dev/posts/over-543-000-valid-credentials-exposed-in-public-github-repositories-fblhmhuem) · BleepingComputer · 1 upvotes · 0 comments - [Meta admits to Instagram password reset mess, denies leaks](https://daily.dev/posts/meta-admits-to-instagram-password-reset-mess-denies-leaks-gskm0ords) · The Register · 2 upvotes · 0 comments - [Discord’s recent support data breach exposes user info, ID photos, and credit card details](https://daily.dev/posts/discord-s-recent-support-data-breach-exposes-user-info-id-photos-and-credit-card-details-u1kvsfzr5) · Tech Lead Digest · 3 upvotes · 1 comments --- Tags: [#data-breach](https://daily.dev/tags/data-breach), [#discord](https://daily.dev/tags/discord) [View this post on daily.dev](https://daily.dev/posts/double-counter-discord-bot-breach-exposes-about-1-million-email-addresses-iyyh5haou) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Double Counter Discord bot breach exposes about 1 million email addresses","url":"https://daily.dev/posts/double-counter-discord-bot-breach-exposes-about-1-million-email-addresses-iyyh5haou","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/double-counter-discord-bot-breach-exposes-about-1-million-email-addresses-iyyh5haou"},"datePublished":"2026-10-07T19:28:05.983Z","dateModified":"2026-10-07T19:28:41.944Z","description":"Double Counter, a Discord anti-raid and anti-alt-account protection service, suffered a breach on October 4 after attackers exploited a vulnerability in...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f36f367de4eb147b0eb19ed672a0452b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f36f367de4eb147b0eb19ed672a0452b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/double-counter-discord-bot-breach-exposes-about-1-million-email-addresses-iyyh5haou","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"data-breach,discord","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Double Counter Discord bot breach exposes about 1 million email addresses"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/double-counter-discord-bot-breach-exposes-about-1-million-email-addresses-iyyh5haou#faq","mainEntity":[{"@type":"Question","name":"How did attackers breach the Double Counter Discord bot service?","acceptedAnswer":{"@type":"Answer","text":"Attackers exploited a vulnerability in Metabase, a publicly accessible analytics tool running on a legacy server, to obtain cloud credentials. They held access for just under six hours on October 4, during which they exfiltrated data, stole a bot token to post malicious links in about 50 large Discord servers, and made over $7,000 in fraudulent payment charges. Teams running Metabase or similar analytics tools can track emerging vulnerability disclosures on daily.dev."}},{"@type":"Question","name":"How many accounts were affected by the Double Counter Discord bot data breach?","acceptedAnswer":{"@type":"Answer","text":"Roughly 1 million email addresses were exposed, along with Discord IDs and IP addresses for tens of millions more accounts. Have I Been Pwned confirmed that 274,900 email addresses and usernames were publicly released as part of the breach, which was attributed to the Metabase vulnerability. Anyone who used a Discord moderation bot can follow breach disclosures like this one on daily.dev."}},{"@type":"Question","name":"What did Double Counter do after its breach to prevent further damage?","acceptedAnswer":{"@type":"Answer","text":"Double Counter disabled the stolen credentials, rotated its secrets, and moved its databases onto private networks. It also notified France's data protection regulator, the CNIL, as part of its incident response following the Metabase-related breach. Engineers building incident response playbooks can compare real breach remediation steps on daily.dev."}}]} ```