A Discord verification bot used by more than 600,000 gaming communities became the latest cautionary tale in third-party app security this month. Tellter SAS, the Paris-based operator of the anti-alt-account bot Double Counter, confirmed on October 5, 2026 that an attacker spent nearly six hours inside its cloud infrastructure on October 4, copying roughly 12 GB of data tied to an estimated 28 million Discord accounts. The breach did not touch Discord’s own servers, but it exposed the fragile trust chain that gaming communities, esports organizers, and Discord server owners lean on every day when they install third-party bots to fight raids, bans, and duplicate accounts.
The incident lands in the middle of an unusually rough October 2026 for gaming-account security. Square Enix warned Final Fantasy XIV players on October 19 to change their passwords after a wave of credential-stuffing logins, PlayStation Network users reported eight separate account-takeover incidents between late September and early October, and security researchers flagged a login-process flaw in EA’s games on October 20 that could let attackers hijack player accounts. The Double Counter breach is the largest of the bunch by account count, and it offers the clearest look yet at how a single forgotten server can cascade into tens of millions of exposed records.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened in the Double Counter Discord Breach
Double Counter is a Discord app that server owners install to verify new members, flag alt accounts, and block raid attempts; its own marketing describes “3-second verification” with a claimed “98% detection rate.” According to Tellter’s incident report, the October 4 intrusion was a deliberate, multi-stage attack rather than an opportunistic scan. The attacker first reached an old, internet-exposed hosting server that Tellter had kept running after migrating most of its infrastructure elsewhere. From there, the intruder pivoted into Double Counter’s production cloud environment and remained active for close to six hours before Tellter’s team cut off access, replaced the exposed credentials, and restored the service the same day, with Tellter saying it brought the bot back online at 19:19.
Double Counter publicly disclosed the incident on October 5 and notified France’s data protection authority, the CNIL, the same day. The company has said it will also file a criminal complaint. Discord itself was not compromised, and Double Counter said customer funds were secured and that no stored card numbers were exposed in the breach.
How Attackers Got In: A Forgotten Legacy Server
What Is Metabase, and Why Was It Running Unpatched?
The entry point, according to multiple incident reports reviewed after the disclosure, was an outdated instance of Metabase, an open-source business-intelligence and analytics tool, left running on a legacy Tellter server that should have been decommissioned. Metabase itself is a legitimate, widely used product; its current commercial tiers run from a free self-hosted open-source edition to a Metabase Cloud Starter plan at $100 a month, a Pro plan at $575 a month, and Enterprise pricing starting at $20,000 a year, according to Metabase’s own pricing page. The problem in the Double Counter case was not the software itself but an unpatched, publicly reachable deployment of it that nobody had torn down.
Once inside that legacy environment, the attacker reportedly found credentials that still had a path into Double Counter’s live cloud infrastructure, letting them move from a forgotten analytics dashboard to the systems that process real account data for hundreds of thousands of Discord servers. It is a pattern security teams have seen repeatedly in 2026, most recently in the ConnectWise cloud-backup breach that locked out 173 managed-service-provider tenants after attackers exploited leftover access paths. Legacy infrastructure, not the flagship product, keeps being the weak link.
What Data Was Exposed
Double Counter’s own disclosure breaks the exposure into several categories, with the scale varying by data type. The company has been explicit that the 28 million figure refers to records it is treating as potentially exposed, not confirmation that all of them were published or misused.
| Data category | Estimated accounts affected | Notes |
|---|---|---|
| Discord IDs and usernames | ~28 million | Core dataset cited in Tellter’s disclosure |
| IP addresses and coarse geolocation (country, region, city, ISP) | ~27 million | Raises phishing and profiling risk |
| User-agent hashes | ~25 million | Device-level fingerprinting data |
| Email addresses | ~1 million | Added to Have I Been Pwned’s breach catalog |
| Paying-subscriber records (names, country, postal code) | Unspecified subset | Reported for Double Counter’s premium tier customers |
| Passwords and stored payment card numbers | 0 | Double Counter and Discord both say these were not exposed |
During the intrusion, the attacker also reportedly seized control of Double Counter’s own Discord bot token and used it to post invitation links to an attacker-controlled server inside dozens of the large gaming communities where Double Counter was installed, a tactic that turns a security tool into a distribution channel for the attacker’s own infrastructure, according to Dexerto’s reporting on the incident. A stolen payment key tied to a separate Tellter product was also reportedly used to run several thousand dollars in fraudulent charges, which the company says were refunded.
Discord’s Response: “Not a Breach of Discord,” But Action Taken Anyway
Discord moved quickly to draw a line between its own platform and a third-party app running on top of it. A Discord spokesperson told GamesIndustry.biz: “We’re aware of a security incident involving Double Counter, a third-party app available on Discord. While this was not a breach of Discord, we’ve disabled new installs of the app while we work with Double Counter to understand the full scope of the incident, and we’ll take further action as appropriate.”
Discord’s official support account echoed that framing publicly: “We’re aware of a security incident involving Double Counter, a third-party bot developer. We’ve confirmed Discord’s systems were not breached. We are preventing new server installs of Double Counter’s app while we investigate the incident. We’re working closely with Double Counter and will take further actions as appropriate to protect our users,” Discord Support said.
That distinction matters legally and reputationally for Discord, but it is of limited comfort to the server owners and members whose data ended up in Double Counter’s database simply because they trusted a popular, highly rated verification bot. Blocking new installs stops the bleeding for communities that have not yet added Double Counter, but it does nothing for the roughly 28 million accounts whose data had already passed through the compromised system before October 4.
Tellter’s Incident Response, in Its Own Words
Double Counter’s operator did not try to minimize what happened. In its public incident report, cited by Machine.news, the company described the mechanics of the attack directly: “During the attack they took control of the bot’s Discord token, used it to post links to their own Discord server in about 50 large servers, copied part of one of our databases, and used a stolen payment key to commit financial fraud on a separate account.”
On containment, Tellter was similarly direct: “We cut off their access, found no persistence, replaced the exposed credentials and restored the service at 19:19. We sincerely apologise to everyone affected.” That same-day containment and restoration timeline is notably faster than many enterprise breaches, where dwell time is often measured in weeks rather than hours, even if the legacy-server root cause reflects a basic infrastructure-hygiene failure rather than a sophisticated zero-day.
Regulatory Notification and Legal Exposure
Tellter’s decision to notify France’s CNIL within 24 hours of discovering the breach puts it on the right side of GDPR’s 72-hour breach-notification requirement, a deadline that has tripped up far larger companies. Whether that notification shields the company from CNIL penalties depends on factors the public disclosure does not cover, including how long the vulnerable Metabase instance had been exposed before the attack and whether Tellter can show it followed reasonable security practices for a company handling tens of millions of users’ identifiers. Given the company’s scale, a venture studio describing itself as running eight live products with roughly $309,000 in combined annual recurring revenue, as BiGGo’s coverage of the breach noted, any meaningful regulatory fine would be a significant event for the business, separate from the reputational cost of the breach itself.
Why This Matters for 600,000+ Gaming Communities
Double Counter’s own marketing claims it is “trusted by 600,000+ Discord communities,” a figure that, if accurate, makes it one of the more widely deployed moderation and anti-alt-account tools on the platform. That scale is exactly why the breach matters beyond its immediate victims. Discord server owners, particularly those running gaming clans, esports organizations, and large fan communities, routinely grant third-party bots deep permissions: the ability to read member lists, ban users, and act on the server’s behalf. Those permissions are necessary for a verification bot to do its job, but they also mean that a single compromised bot vendor can expose data across hundreds of thousands of unrelated communities simultaneously, something a breach at any single game studio typically cannot do.
The 50-plus large communities where the attacker’s token hijack pushed malicious invite links illustrate the second-order risk: a compromised bot does not just leak static data, it can actively act against the users of every server where it is installed, for as long as the attacker controls its credentials.
2026’s Wave of Gaming-Platform Security Incidents, Compared
The Double Counter breach is the largest by account count among several gaming-platform security stories in October 2026, but the incidents differ meaningfully in cause and in who is actually responsible for fixing them.
| Incident | Reported date | Root cause | Scale | Status |
|---|---|---|---|---|
| Double Counter / Discord bot | Oct. 4, 2026 | Exposed legacy server running outdated Metabase; credential reuse into production | ~28 million accounts | Contained same day; CNIL notified |
| Square Enix FFXIV | Oct. 19, 2026 | Credential stuffing using passwords leaked from unrelated services | Unspecified wave of unauthorized logins | Players told to reset passwords |
| PlayStation Network account takeovers | Late Sept.–early Oct. 2026 | Social engineering of Sony support staff, not a server breach | At least 8 separate public reports | Sony has not issued a public statement |
| EA Games login flaw | Oct. 20, 2026 | Security flaw in login process reported by researchers | Potential account takeover, scope unconfirmed | Reported; EA response pending |
The common thread across all four is that none of them involve a brand-new, exotic attack technique. Credential stuffing, support-desk social engineering, an exposed legacy server, and an unpatched login flow are all well-documented attack categories. What changed in 2026 is the target: gaming accounts, once seen as low-value compared to banking logins, now carry real financial weight through skins, in-game currency, linked payment methods, and resale-able digital inventories, making them a more attractive target for credential-stuffing operations and account-takeover crews than they were a few years ago.
Historical Context: Third-Party Bots as a Gaming Supply-Chain Risk
The Double Counter incident fits a pattern security researchers have been warning about since Discord’s bot ecosystem expanded sharply in size over the past several years: the platform’s own infrastructure can be reasonably secure while the long tail of third-party apps built on top of it varies wildly in security maturity. Unlike a breach at a major publisher with a dedicated security team and an established disclosure process, bots like Double Counter are frequently built and operated by small teams, in this case a venture studio managing eight separate live products simultaneously, where security investment has to compete directly against feature development and user growth.
That dynamic mirrors earlier software supply-chain incidents in other industries, where a trusted vendor’s infrastructure, rather than the end platform, became the point of failure. The difference with Discord bots is the scale of blast radius relative to vendor size: a single small company’s legacy server mistake reportedly touched tens of millions of accounts across more communities than most individual game studios serve directly.
Market Impact: Pressure on Discord, Tellter, and Bot Developers
For Discord, the immediate cost is reputational and operational: temporarily blocking new installs of a popular bot used by 600,000-plus servers is disruptive for the communities relying on it for anti-raid protection, and it adds pressure on Discord to formalize security review requirements for the third-party apps listed in its directory. For Tellter, the breach threatens the core asset of a security product, which is trust; an anti-alt-account bot that itself gets breached invites direct comparisons to running antivirus software that turns out to carry malware.
More broadly, the incident adds urgency to a question gaming-community operators and platform holders have been circling all year: whether verification, anti-cheat, and moderation tooling built by small third-party vendors needs the same security scrutiny that platforms apply to payment processors or ad networks. Ransomware and breach volumes across the broader economy are already climbing, with year-over-year ransomware attack counts up 53% in separate reporting published this month, and gaming-adjacent infrastructure is increasingly part of that trend rather than separate from it.
What Gaming Server Admins Should Do Now
Server owners who installed Double Counter, or any third-party verification bot, cannot change what has already been copied, but there are concrete steps worth taking while Tellter and Discord continue investigating.
1. Check Have I Been Pwned for your account's email address
to see if it appears in the Double Counter dataset.
2. Review every bot installed on servers you own or moderate:
Server Settings > Integrations > review OAuth scopes granted.
3. Remove permissions (ban, kick, manage roles) from bots that
do not strictly need them for their core function.
4. Enable Discord's built-in two-factor authentication on your
own account, independent of any third-party bot.
5. Warn server members that attacker-controlled invite links
may have been posted during the incident window (Oct. 4, 2026).
6. Monitor for phishing attempts referencing "Double Counter,"
"verification required," or similar re-verification prompts.Security teams generally recommend treating any bot-driven “re-verify your account” prompt with suspicion for weeks after an incident like this, since attackers routinely use the cover of a real breach disclosure to run convincing phishing campaigns against the same victim population. Gaming accounts have also become a popular target for automated intrusion tooling that scans for exactly these kinds of exposed credentials at scale, so individual vigilance matters more, not less, once a dataset like this starts circulating.
Predictions: Where the Double Counter Fallout Goes Next
- Expect Discord to extend the Double Counter install block into a broader, longer-term security review requirement for high-permission bots in its app directory, rather than a one-off suspension.
- Have I Been Pwned’s dataset covering roughly 1 million email addresses tied to the breach will likely grow as researchers cross-reference the other exposed categories, such as IP addresses and user-agent hashes, against known identity datasets.
- Tellter faces a realistic path toward a CNIL inquiry given the scale of the exposure, even with same-day notification working in its favor; the outcome will shape how other small Discord-bot operators handle disclosure going forward.
- Competing verification and anti-alt-account bots will likely use the breach as a marketing opportunity, emphasizing audited infrastructure and bug-bounty programs to court the migration of Double Counter’s 600,000-plus installed communities.
- Expect at least one more gaming-platform credential or account-takeover story before year-end 2026, continuing the pattern already set by Square Enix, PlayStation Network, and the Double Counter incident this October.
Frequently Asked Questions
Was Discord itself hacked?
No. Discord has stated directly that its own systems were not breached. The incident affected Double Counter, a third-party bot built and operated by Tellter SAS, which runs on top of Discord’s platform.
How many accounts were affected by the Double Counter breach?
Tellter’s disclosure put the figure at roughly 28 million Discord IDs and usernames, with about 27 million IP addresses and coarse location records and roughly 1 million email addresses also reportedly copied.
Were passwords or payment card numbers exposed?
Both Discord and Double Counter say no. The company has stated that stored card numbers were not exposed and that customer funds were secured, though a stolen payment key tied to a separate Tellter product was reportedly used for several thousand dollars in fraudulent charges that were refunded.
Can I still use Double Counter?
Discord has disabled new server installations of Double Counter while it investigates the incident with Tellter. Servers that already had the bot installed before October 4, 2026 may still be running it, though admins should review its permissions given the breach.
How did the attacker get in?
Reports describe an outdated, internet-accessible instance of Metabase, an analytics tool, left running on a legacy Tellter server. Credentials found there reportedly gave the attacker a path into Double Counter’s production cloud infrastructure.
Did Tellter notify regulators?
Yes. Tellter said it notified France’s data protection authority, the CNIL, on October 5, 2026, one day after discovering the breach, and said it intends to file a criminal complaint.
Is this related to the Square Enix or PlayStation account issues this month?
Not directly. Those incidents involve credential stuffing against Final Fantasy XIV accounts and social engineering of PlayStation support staff, respectively. They are separate from the Double Counter breach but reflect the same broader 2026 trend of gaming accounts becoming a higher-value target for attackers.
What should I do if my data was in the breach?
Check Have I Been Pwned using the email address linked to your Discord account, review and tighten the permissions of any bots installed on servers you manage, enable two-factor authentication on your Discord account, and treat any unexpected “re-verification” prompts referencing Double Counter with suspicion.
