Double Counter, a Discord bot that verifies members for server owners, says data tied to about 28M Discord accounts is treated as exposed after an attack on 4 October, according to an incident report published by Tellter, the French company that runs it. Have I Been Pwned lists 274,922 email addresses and usernames from the breach as published online.
By our arithmetic, the published set is about 1.0% of the accounts the company treats as exposed, and the roughly 1.0M email addresses it says were copied are about 3.6% of them. The company’s website says it is trusted by 600K+ communities.
Business Pill · Least Privilege
A short explainer on the least-privilege principle. It teaches the general idea only and says nothing about this breach.
The key insight: As we read it, the company’s own report traces the way in to a server it no longer used, which held credentials that reached the live cloud where the data was copied.
The report, first published on 5 October and updated on 21 October, says the attacker got in through an old server from its previous hosting setup that was no longer in use. It says: “The way in was a self-hosted analytics tool (Metabase) that was still running, and publicly reachable, on that retired server”.
The report counts 5 h 51 min of attacker activity in its cloud, about 12 GB copied from one database, and about 50 large servers where the bot posted links to the attacker’s own Discord server. It also says the attacker kept adapting: “When we set a new bot token, they read it within two minutes.”
The company says it cut off access, found no backdoor and restored the service at 19:19 UTC the same day. “We sincerely apologise to everyone affected,” the report says.
Records affected by the 4 October 2026 Double Counter breach, by data type, from the company’s incident report (updated 21 October) and Have I Been Pwned (added 7 October). Published emails are about 1.0% of the roughly 28M accounts treated as exposed; emails are about 3.6% of them (our arithmetic).
What Was Exposed
The report lists Discord user IDs and usernames for about 28M accounts and IP addresses with coarse location for about 27M, both partly copied and treated as exposed. For one table of about 21.7M verified users, it says “from the volume transferred we estimate that about 20% had left, and because we cannot tell which rows, we treat the whole set as exposed.”
It says about 1.0M de-duplicated email addresses were copied, and payment-provider records for about 5,000 customers were copied and partly published. Have I Been Pwned, which added the breach on 7 October, lists email addresses, geographic locations, names and usernames as the exposed data classes.
The report also says: “Not affected: Discord passwords, which Double Counter never receives, and full card numbers and security codes, which only our payment provider holds and which were never accessible.” It describes $7,331 charged fraudulently on a separate Tellter payment account, of which $7,322 was refunded the same day.
What the Company Tells Users to Do
For server administrators, the report advises deleting any message sent by Double Counter on 4 October between 12:00 and 16:30 UTC that invites people to another server, and checking audit logs for that window. For members, it says: “Nothing to change on your Discord account.”
To Doogle users, advertisers and API customers, it warns: “your email address was exposed, so expect phishing attempts.” The company says it notified France’s data protection authority, the CNIL, on 5 October and has been emailing about 1 million affected people since 21 October.
As we read the report, the attacker did not need a new account: it says they used two existing credentials found on that retired server, which is part of why the activity initially blended in.
By our arithmetic, the 274,922 published emails and usernames are about 1.0% of the roughly 28M accounts the company treats as exposed.
As we read it, the 28M and 27M counts are a ceiling by the company’s method: it treats those records as exposed when it cannot tell which rows were copied.
Double Counter incident report, updated 21 October 2026
“When we set a new bot token, they read it within two minutes.”
Three Implications
FOR DISCORD SERVER OWNERS The report advises deleting any Double Counter message sent on 4 October between 12:00 and 16:30 UTC that invites people to another server, and checking audit logs for that window.
FOR AFFECTED USERS The report says Discord passwords and full card numbers were not affected, and warns Doogle users, advertisers and API customers to expect phishing attempts.
FOR COMPANIES RUNNING THIRD-PARTY BOTS The report says the attacker used the bot’s token to give their own account Administrator rights on the company’s support server and to unban that account after staff banned it.
The framework says: “The governance layer sits at the intersection of capability, regulation, national security, access control, and geopolitical alignment.”
As we read it, a bot trusted to grant roles in many communities is an access-control layer in miniature. The framework predates this breach and does not discuss it.
The report does not say who the attacker is. For the roughly 28M ID and username records, the roughly 27M IP and location records and the 21.7M verified-users table, it says the data was partly copied and treated as exposed because it cannot tell which rows left, so those three counts are upper bounds by the company’s own method. The figures here come from the company’s report and Have I Been Pwned; we did not verify the published data set.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
Double Counter says data tied to about 28M Discord accounts is treated as exposed after a 4 October attack that began on a retired server still running an analytics tool. About 275,000 emails and usernames are already online, Have I Been Pwned says. That is about 1.0% of the affected accounts, by our arithmetic.
A note on sourcing. Figures come from Double Counter’s own incident report (updated 21 October) and Have I Been Pwned’s breach entry, read on 1 November. We did not obtain or inspect the published data. Our arithmetic is labelled.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
