Double Counter: 28 Million Discord Accounts Exposed via…

The Double Counter anti-alt bot leaked data on 28 million Discord users after an attacker compromised an abandoned OVH server running an outdated Metabase instance, stole the bot's Discord token, and exfiltrated nearly 12 GB of data including IP addresses, coarse geolocation, and almost one million email addresses.

On October 4, 2026, a legacy server in Tellter's former OVH infrastructure—Tellter operates the Double Counter anti-alt-account bot—was compromised. The attacker extracted an API token from an active container, posted messages in roughly 50 large Discord communities, and exfiltrated nearly 12 GB of data tied to approximately 28 million accounts. The stolen data included IP addresses, coarse geolocations, and nearly one million email addresses.

Key Takeaways

The Double Counter bot, installed on over 600,000 Discord servers, suffered a breach on October 4, 2026 exposing data for ~28 million accounts.
Entry came through an abandoned OVH server running an outdated, publicly exposed analytics tool no longer under active management but still reachable.
The attacker stole the bot's Discord token, posted invite links in ~50 large servers, and racked up $7,316 in fraudulent charges on a corporate card.
Discord disabled new installs of the bot, clarifying the incident was not a breach of Discord's own platform.

From Outdated Analytics Tool to Stolen Discord Token in Six Hours

According to the incident report published by Double Counter and covered by Tech Insider and Instant Gaming News, the attacker compromised an "abandoned" server from Tellter's previous OVH hosting setup. The server was still running a business-intelligence analytics tool—Metabase—in a version with a known vulnerability exposed to the public internet. Cybernews reports the exploitation opened a shell inside a running bot container, from which the Discord token was extracted.

The activity window was compact: roughly six hours, from 12:00 to 16:30 UTC. In that span the attacker obtained the token, used it to post invites to their own server in about 50 large Discord communities, copied part of a relational database, and stole a payment key for fraudulent transactions. Double Counter revoked payment-provider keys at 17:14 UTC and restored service at 19:19 UTC the same day.

The total volume of copied data is nearly 12 GB. Sources converge on three partially overlapping datasets: Discord identifiers and usernames for ~28 million accounts; IP addresses and coarse geolocation for ~27 million; hashed user-agents for ~25 million. Full email addresses copied total roughly one million, of which ~840,000 are tied to the "Doogle" service and ~240,000 to dashboards and administrative contacts. Approximately 275,000 email-username pairs were published by the attacker; Have I Been Pwned records 274,900.

"The attacker broke into a server from our previous hosting setup through a vulnerability in an analytics tool it was still running, then used credentials found on that server to reach our cloud infrastructure and adapted to each of our containment steps"

— Double Counter/Tellter, incident report, reported by Tech Insider and Instant Gaming News

The $7,316 Fraud and Containment Timeline

The impact extended beyond exfiltration. The attacker used the stolen payment key for a sequence of escalating charges—$1, $10, $100, and $1,000—totaling $7,316 on a corporate card. Two customers incurred $18 in combined charges, also refunded. Double Counter specifies no stored credit-card numbers were exposed; the fraud occurred via account and API key abuse, not through access to a payments database.

Tellter's response is documented with precise timestamps: payment revocation at 17:14, service restoration at 19:19. According to Dexerto, the Discord token had been rotated but was reportedly compromised again shortly after; other sources do not confirm this specific detail on timing, and the brief classifies it as an unresolved conflict between sources. Messages sent with the compromised token, per Double Counter staff speaking to Cybernews, traversed Discord directly without passing through Double Counter systems; the team identified affected servers from incoming reports and the bot's message history.

What to Do Now

Discord users who previously authorized Double Counter can check whether their email appears in the published dataset via Have I Been Pwned. Server administrators who had the bot installed should review moderation logs from October 4, 2026 for any spam messages sent by the compromised bot. The notification sent to the French CNIL on October 5, 2026 indicates data-protection authorities are examining Tellter's practices.

Risk Profile: What Exposure of This Data Enables

The exfiltrated data forms a composite profile: Discord identifiers, IP addresses with coarse geolocation, hashed user-agents, and—for a minority—plaintext emails. This profile could enable targeted phishing campaigns, cross-platform correlation, and social-graph reconstruction, though available sources document no concrete misuse as of publication.

Discord disabled new installs of the bot on October 4, 2026. In a statement reported by Dexerto, a Discord spokesperson said: "We're aware of a security incident involving Double Counter, a third-party app available on Discord. While this was not a breach of Discord, we've disabled new installs of the app while we work with Double Counter to understand the full scope of the incident, and we'll take further action as appropriate." The technical distinction is correct: the breach hit Tellter's infrastructure, not Discord's systems.

Discord passwords were not held by Double Counter and were not exposed. A cold-storage database with ~58 million users was not accessed; the behavioral database was untouched.

Double Counter's Shutdown as the Point of No Return

Discord's disabling of new installs marks the point of no return for Double Counter. The bot, which requires extensive administrative permissions on hundreds of thousands of servers, has lost the ability to acquire users. The CNIL notification of October 5, 2026 opens a regulatory review of Tellter's practices. The attacker's identity remains unconfirmed; investigations are ongoing in France and the U.S.

The case illustrates how a legacy server left standing after a cloud migration can serve as a bridge into operational infrastructure. The information in this article is based on available editorial sources; multi-source verification on technical details is not applicable given the absence of structured primary sources with vulnerability data.

Sources: Tech Insider, Cybernews, Insider Gaming, GamesIndustry.biz, Instant Gaming News, Dexerto, Have I Been Pwned, Discord Safety

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter