Verification service Double Counter has been targeted by a hacker attack that exposed the identities and location data of around 28 million Discord accounts. The attackers controlled the company’s cloud infrastructure for around six hours.
Verification service Double Counter has been targeted by a hacker attack that exposed the identities and location data of around 28 million Discord accounts. The attackers controlled the company’s cloud infrastructure for around six hours.
This is stated in a security incident report published on the Double Counter blog. The attack occurred on October 4, 2026, and the service was fully isolated and restored the same day after a complete replacement of all credentials and access keys.
The intrusion occurred via an outdated OVH server that was no longer used in the main system. By exploiting a vulnerability in the open Metabase tool, the attacker gained access to the server, service account keys, and administrative session. This allowed him to infiltrate the cloud, grab a Discord bot token, and send spam links to his own server in about 50 large communities.
Despite the team’s attempts to stop the attack, the attacker adapted and intercepted new tokens. Before his session was finally closed, the attacker deleted backups, changed the database password, and copied about 12 GB of information. In addition to Discord data, about 1 million email addresses of Doogle users, advertisers, and customers were affected by the leak. At the same time, the company notes that cold storage for 58 million users, behavioral analytics, Discord passwords, and bank card data were not affected.
Separately, the hacker used a stolen Stripe key from another product to perform test fraudulent charges. He transferred $7,316 from his own company card and $18 from the cards of two customers who had already been refunded.
To mitigate the impact of the incident, the team completely deleted the compromised accounts, moved the databases to a private network, updated all keys, and implemented real-time monitoring. Discord server administrators are advised to delete all bot messages during the attack period, and users are advised to beware of phishing emails.
