Popular Discord Security Bot Double Counter Hijacked in Massive Cyberattack Exposing 28 Million Users

Digital communication giant Discord has deactivated new installations of Double Counter, one of the platform’s most widely deployed security bots, following a severe cyberattack that compromised data associated with roughly 28 million user accounts. Occurring on October 4, 2026, the six-hour security incident was publicly disclosed by Tellter, the parent operating company behind Double Counter. Deployed across more than 600,000 Discord communities to filter out raid groups, alternate accounts, and unauthorized VPN connections, the bot was temporarily hijacked by an intruder who used its internal privileges to post spam invites and exfiltrate user databases.

How Did the Attacker Hack Double Counter Cloud Systems?

According to Tellter’s technical disclosure report, the initial entry point was an obsolete legacy server hosted on OVH infrastructure. While no longer connected to active production services, the machine remained online and accessible via the internet running an outdated instance of the Metabase analytics tool.

Exploiting a security vulnerability in Metabase, the threat actor forged an administrator session to extract stored cloud credentials, including a high-privilege service account key. Operating with legitimate administrator credentials, the attacker gained access without triggering automated system alarms.

By opening a shell within a active bot container, the intruder extracted Double Counter’s live Discord access token. Armed with the bot’s identity token, the attacker granted themselves administrator permissions on the official Double Counter support server, revoked their own prior ban, and broadcast malicious server invitation links across roughly 50 major Discord communities, including popular servers like Steal a Brainrot.

What Discord User Data Was Copied and Exposed During the Breach?

Tellter confirmed that while its cold-storage behavioral database covering 58 million users remained untouched, significant portions of active user databases were copied or partially exposed before defenders terminated the malicious session:

• Discord IDs and Usernames: Approximately 28 million accounts had their unique IDs and account handles partially copied and marked as exposed.
• IP Addresses and Geolocation Data: Roughly 27 million accounts had IP records, country codes, regional markers, city names, postal codes, and internet service provider (ISP) identifiers exposed.
• User Agent Signatures: Around 25 million accounts had their browser user-agent hashes copied.
• Email Records: Approximately 1 million email addresses were exfiltrated, including 840,000 Google account emails and 240,000 dashboard administrator and business contact emails.

Double Counter confirmed that user Discord account passwords were never held or accessed. Financial payment details remain processed entirely by external third-party providers. However, the attacker briefly utilized a stolen payment API key from Atis, another Tellter service, to execute $7,316 in unauthorized test charges against a corporate card alongside minor charges to two clients, all of which were immediately refunded.

What Action Should Server Administrators and Discord Members Take?

Tellter and Discord security analysts recommend several immediate steps for community leaders and server members to protect their accounts and communities:

• Server Audit Log Cleanup: Community administrators should inspect their server audit logs for actions performed by Double Counter on October 4 between 12:00 and 16:30 UTC. Any automated messages or channel posts inviting users to external servers during that window must be deleted immediately.
• Avoid Unsolicited Links: Discord users should refrain from clicking server invites or verification links posted in automated bot messages originating from the incident timeframe.
• Phishing Vigilance: Because approximately one million email addresses were exposed, users, server owners, and API clients should remain on high alert for targeted email phishing schemes. Tellter emphasizes that it will never request passwords, tokens, or payments via direct message or email.
• Re-Verification Requirements: Users who attempted verification through Double Counter between 13:39 and 14:49 UTC on October 4 without receiving their expected server roles must re-verify through official server prompts.

Tellter officially reported the data security breach to France’s data protection agency, the CNIL, on October 5, 2026. The company has retained legal counsel to initiate legal proceedings and file criminal complaints in both France and the United States, utilizing system logs, Discord direct messages, and forensic technical indicators to track those responsible.