Double Counter Discord bot breach: what home users should do

If you use Discord at home, this one is worth five minutes even if you never installed a bot yourself. On October 4, 2026, the third-party Discord server bot Double Counter (operated by Tellter SAS) was hit in a multi-stage attack. Discord’s own systems were not breached. Plenty of personal Discord IDs, IPs, and some email addresses still left through that vendor.

Have I Been Pwned later loaded a public corpus from the incident. Phishing that pretends to be “Discord security” or “Double Counter verification” is the practical risk for normal people now.

What happened (sourced)

Tellter’s Security Incident Report for 4 October 2026 (published October 5, status contained) says:

• Attackers broke into a retired OVH server that still ran a publicly reachable analytics tool (Metabase), then used credentials found there to reach Double Counter’s cloud.
• Roughly 5 hours 51 minutes of attacker activity in the cloud (12:03 to 17:54 UTC on October 4).
• About 12 GB copied from one database.
• The bot’s Discord token was stolen and used to post links to the attacker’s server in about 50 large servers.
• Service restored at 19:19 with new credentials. Tellter says a full audit found no backdoor left behind.

Personal data Tellter treats as exposed (approximate counts from that report):

• ~28 million Discord user IDs and usernames
• ~27 million IP addresses with coarse geolocation (country, region, city, postal code, ISP)
• ~25 million user-agent hashes used for alt detection
• ~1.0 million de-duplicated email addresses (Doogle accounts, dashboard contacts, advertisers, and related contacts)

Tellter states Discord passwords were not in the affected database (Double Counter never receives them), and stored payment card numbers stay with the payment provider. A separate Tellter product account saw $7,316 in fraudulent test charges plus two small customer charges that were refunded. Double Counter subscription payment processing showed no unauthorized charges, per the report.

Have I Been Pwned’s Double Counter breach entry says a published corpus contained about 275,000 unique email addresses and Discord usernames, and that HIBP added the breach on October 7, 2026. That public dump is a subset of Tellter’s larger “treated as exposed” counts, not proof you are safe if your address is missing from HIBP.

Discord told press it disabled new installs of the app while reviewing scope with Double Counter, and that this was not a breach of Discord itself.

Why a home Discord user should care

You do not need to be a server owner for this to matter.

• Many servers force “verify with Double Counter” before you can chat. Completing that flow can put your Discord ID (and sometimes more) into that vendor’s database.
• Stolen email addresses turn into phishing. Expect messages that fake Discord login alerts, “re-verify or lose access,” or payment problems.
• Stolen Discord IDs and usernames help attackers craft believable friend requests and DMs.
• IP and coarse location data is useful for scammers who want to sound local or timed to your usual hours.

Discord passwords were not in this dump, per Tellter. That does not mean you should ignore weird Discord-looking emails or DMs.

What to do on your own accounts

1. Check whether your email showed up

1. Open Have I Been Pwned and search the email addresses you actually use with Discord-related services.
2. If Double Counter appears, treat that address as phishing bait for the next few months.
3. If it does not appear, you may still be in Tellter’s larger exposed set. Stay skeptical anyway.

2. Harden Discord itself

1. Open Discord User Settings → My Account and turn on two-factor authentication if it is not already on.
2. Open Authorized Apps (under User Settings) and remove apps you do not recognize or no longer want. If Double Counter is listed and you want it gone from your account, deauthorize it.
3. Review Devices / login locations if Discord shows them, and sign out sessions you do not recognize.
4. Do not change your Discord password just because a random DM told you to. Change it only through Discord’s own settings if you choose to rotate it.

Tellter’s member guidance in the incident report: nothing required on your Discord account password, do not join servers advertised in unexpected Double Counter messages, and re-verify if you verified between 13:39 and 14:49 UTC on October 4 without getting your role.

3. Treat “Discord security” mail and DMs as hostile

• Discord and Double Counter will not ask for your password, 2FA codes, or payment details in email or Discord DMs (Tellter says the same in its report).
• Hover links. If the domain is not discord.com (or the real doublecounter.gg site you typed yourself), close it.
• Do not scan mystery QR codes from strangers “to restore your account.”
• If a message pressures you to move to another server “for safety,” walk away.

4. If you run a small home or friend server

Tellter asks server admins to:

• Delete any Double Counter message from October 4 between 12:00 and 16:30 UTC that invites people to another server.
• Check the server audit log for Double Counter actions in that window.

If your friend group no longer needs the bot, remove it from the server and pick a simpler verification method you actually understand.

Do this / don’t do that

Do

• Search your email on Have I Been Pwned for the Double Counter entry.
• Turn on Discord 2FA and review authorized apps.
• Expect phishing that name-drops Discord, verification, or Double Counter.
• Remove bots and apps you do not need. Less vendor sprawl means less blast radius next time.

Don’t

• Do not join servers promoted in unexpected Double Counter posts from early October.
• Do not enter Discord passwords or 2FA codes on pages reached from email or DM links.
• Do not assume “Discord said it was not their breach” means your data was untouched. The vendor database still held Discord-linked records.
• Do not panic about card theft. Tellter did not report Discord passwords or members’ payment cards in the stolen data. The only payment issue it reported was fraud on the Stripe account of its separate Atis product, and it says those charges were refunded.

Bottom line

Double Counter’s October 4, 2026 incident exposed Discord-linked identity data at scale (Tellter incident report, Have I Been Pwned listing). Discord itself was not breached, and Discord passwords were not in that database per the operator. For a home user: check HIBP, enable Discord 2FA, review authorized apps, and treat every “verify again or lose access” message as a scam until proven otherwise.

Image: Official Double Counter Open Graph art (doublecounter.gg).