Across tens of thousands of Discord gaming hubs, tech guilds, and creator communities, new members are routinely barred from sending messages until they click an external link to verify their identity through Double Counter. Marketed as an essential anti-raid and anti-alt bot, Double Counter promises to protect servers by logging IP addresses, browser headers, and hardware fingerprints to catch ban evaders. Today, that security perimeter collapsed: a major data breach has exposed personal records connected to approximately 275,000 unique email addresses.
A new data breach involving Double Counter has exposed information connected to Discord users affecting around 275,000 unique email addresses.
According to Have I Been Pwned, the exposed data includes:
-Email addresses
-Discord usernames
-Names
-Geographic information
-Country and postcode for some paying subscribers
The breach was linked to a vulnerability in Metabase, the analytics platform used by Double Counter.
If you’ve used Double Counter on Discord, check whether your email was affected and stay alert for phishing attempts or suspicious Discord messages.— Pirat_Nation 🔴 (@Pirat_Nation) October 7, 2026
The incident gained global visibility after the compromised dataset was formally validated and ingested into Have I Been Pwned (HIBP), the leading breach monitoring service managed by security researcher Troy Hunt. The disclosure has ignited widespread alarm across the Discord ecosystem, revealing how a tool designed to enforce server hygiene inadvertently created a massive centralized honeypot of user telemetry.
The Compromised Dataset: What Leaked?
Unlike credential-stuffing leaks that merely recycle stale password dumps, the Double Counter database contained rich relational data directly tying pseudonymous Discord identities to real-world identifiers:
- Email Addresses: Roughly 275,000 distinct email accounts registered through verification flows.
- Discord Account Identifiers: Discord usernames, global handles, and linked unique snowflake IDs.
- Personal Names: Real names provided during registration or subscription processing.
- Geographic Location & IP Metadata: IP-derived geolocation coordinates, regions, and cities logged during link clicks.
- Billing Telemetry for Paid Users: Country and postal/ZIP codes belonging to paying subscribers of Double Counter's premium tiers.
The Exploit Vector: An Unsecured Metabase Dashboard
Crucially, the breach did not originate from a failure in Discord's own gateway APIs, nor was it the result of a hijacked bot application token. Instead, the breach was traced directly to an internal infrastructure misconfiguration: a vulnerability in Metabase, the popular open-source business intelligence and database visualization platform utilized by Double Counter's operators.
The Root Cause: Metabase instances deployed without strict network isolation or running unpatched versions have repeatedly been targeted by automated threat actors. Flaws such as unauthenticated pre-auth setup endpoints (e.g., CVE-2023-38646) and improper API access control allow attackers to execute arbitrary queries against connected production databases—enabling total exfiltration of backend customer tables without touching the application frontend.
By finding an internet-facing Metabase instance tied to Double Counter's backend database, attackers were able to bypass standard application barriers and pull the raw telemetry tables wholesale.
The Inherent Hazard of Discord "Verification" Bots
The Double Counter breach underscores a fundamental, systemic flaw in modern community platform security: the verification paradox.
To enter a Discord community, users who value pseudonymity are frequently coerced into clicking external verification links. These bots harvest sensitive telemetry—fingerprinting user browsers, recording external IP addresses, and correlating distinct Discord accounts across multiple servers—under the guise of "stopping raid bots."
In doing so, these services construct enormous, centralized databases that link gamer tags and anonymous handles directly to real-world internet connections and physical postal codes. When that third-party service suffers an unpatched dashboard compromise, the privacy of hundreds of thousands of users is vaporized.
What Affected Users Must Do Immediately
If you have ever clicked a Double Counter verification link in any Discord server, security analysts recommend taking immediate defensive measures:
- Verify Exposure on HIBP: Check your email addresses on Have I Been Pwned to confirm whether your account was included in the 275,000-record dump.
- Brace for Spear-Phishing: Threat actors armed with your Discord username, real name, and email will likely craft convincing spear-phishing emails—frequently impersonating Discord Trust & Safety, server moderators, or crypto/NFT giveaways. Never click external links sent via unsolicited Direct Messages.
- Lock Down Discord Privacy Settings: In your Discord settings under User Settings > Privacy & Safety, restrict Direct Messages from server members in servers you do not actively trust.
- Guidance for Server Administrators: Server owners should audit their reliance on intrusive third-party link-verification bots. Discord's built-in Onboarding, Membership Screening, and AutoMod rules provide robust automated defense against raids without requiring users to hand their IP telemetry to third-party database brokers.
Source & Verification
- Breach Tracker Disclosure: Pirat_Nation on X
- Breach Notification Registry: Have I Been Pwned Database