Inside the Double Counter breach: what a Discord verification bot kept, and how it lost it

If you’ve joined a Discord server in the last few years, there’s a fair chance a bot called Double Counter asked you to click a link and “verify” first. On October 4, 2026, an attacker got into the systems behind that bot and copied about 12 GB of data. The first post on this breach covered the basics when the news broke. This is the longer look: what the bot collected, what its privacy policy promised, how the attacker got in, and how the company handled it afterward.

The short version: a tool meant to stop ban evaders built a large, long-lived database linking Discord accounts to IP addresses and home-area locations, kept it reachable in ways its own policy said it wasn’t, and took 17 days to start emailing the people affected. The company also deserves credit for some things, and this post covers those too.

What Double Counter is

Double Counter is run by Tellter SAS, a company registered in Paris. Server owners add the bot to stop “alts”: second accounts that banned or unwanted members use to get back in. When you join a server that uses it, the bot sends you to a web page. That page records your IP address and browser details and compares them with everyone else who has verified anywhere that uses Double Counter. If you match an account that was banned somewhere, moderators are told.

The bot says it is used by more than 600,000 communities and 3.7 million people a month. Most of the people in its database didn’t pick it themselves. They clicked a link because a server they wanted to join required it.

What happened on October 4

Tellter published a detailed incident report on October 5 and a revised version 2.0 on October 21. By its account (all times UTC):

• The way in was a server Tellter no longer used. An old machine from its previous OVH hosting setup was still running a self-hosted copy of Metabase, an analytics tool, reachable from the internet. A flaw in it let the attacker forge an administrator session. Probing started on October 3 and the attacker logged in at 00:47 on October 4.
• That retired server held live keys to production. It stored a cloud service-account key with administrator rights and an administrator’s saved command-line session. From 12:03 the attacker used them to enter Tellter’s cloud.
• They took over the bot. At 12:26 they opened a shell inside a running bot container and read the bot’s Discord token. From 13:30 they used the bot to post invites to their own server in about 50 large Discord servers, so the messages looked like they came from Double Counter. When staff set a new token, the attacker read it within two minutes.
• They copied the data. Between 15:09 and 15:34 they changed the database administrator password, deleted backups and copied about 12 GB of tables.
• They committed fraud with a stolen payment key. A Stripe key for Atis, a separate Tellter product, was readable in the same cloud. Between 17:03 and 17:13 the attacker made 40 escalating charges against the saved cards of 11 Atis customers, one of them a Tellter company card. 23 went through, for $7,331. Tellter says all of it has been refunded.
• The attacker’s last recorded action was at 17:54. The bot came back at 19:19 with new credentials.

The report doesn’t name the Metabase flaw or say whether a fix for it was available. Dexerto describes it as a known security flaw. Tellter hasn’t said who the attacker is.

What was taken

Tellter worked out what left by comparing the 12 GB with the size of each table, since its copy tool reads tables in a fixed order. Its own counts:

The IP records sat in two tables. One, about 5.4 million rows used for alt detection, was copied in full. The other, about 21.7 million rows of verified users, was cut off partway; Tellter estimates about 20% left, but can’t tell which rows, so it treats them all as exposed. That’s a careful way to count, and it’s the right call.

Discord passwords weren’t involved, because Double Counter never receives them. Full card numbers and security codes stayed with Stripe. Discord says its own systems weren’t breached, and it stopped new installs of the bot while it looked into the incident.

Some of the data is already public. Have I Been Pwned added the breach on October 7 after a set of about 275,000 unique email addresses and Discord usernames was published, along with names, countries and postcodes for a small number of paying subscribers. Whether the IP and location records have been published too isn’t known from reputable sources.

What the published data shows

Frame analyzed the part of the data that has been published, looking only at totals and not at anyone’s record. Nothing from an individual record appears in this post. That portion holds 298,861 records with 294,745 unique email addresses, from two exports:

• a Stripe customer export of 24,400 rows, with 21,646 unique email addresses
• an email marketing contact list of 274,461 contacts

This fits Have I Been Pwned, which lists 274,922 addresses and a breach date of October 4. The records are dated between March and October 2026, and they cover customers of Doogle, Tellter’s sister product, as well as Double Counter.

The customer records hold email addresses, Discord usernames and user IDs, full names, subscription plan and tier, and Stripe account status, with 1,191 accounts marked as delinquent. Nearly every paying customer has a full billing address: street, city, state, postal code and country. The large majority list the United States (23,127), followed by the UK (221), Australia (113) and Canada (95). The customer metadata also holds marketing attribution: the campaign tags (UTM), referring site and landing page that brought each customer in.

The published portion has no passwords, no card numbers and no IP address field. That’s some relief, but it isn’t the whole breach. Tellter’s report says IP data was taken and that about a million email addresses were copied, roughly four times as many as have been published so far.

One figure doesn’t line up. Tellter counts about 5,000 Doogle and Atis payment records, but the published Stripe export alone has more than 21,000 unique customer email addresses. The difference could come from former customers, people who never finished paying, or a different way of counting. The report doesn’t explain it.

What the policy promised, and what the breach shows

Double Counter’s privacy policy was rewritten on October 15, eleven days after the attack. The version archived in September 2026 is the one people were shown when they verified. Set next to the incident report, several of its promises don’t hold up.

“We collect only the minimal personal data necessary (primarily your IP address).” The breach report lists, alongside each IP address, the country, region, city, postal code and internet provider. A postal code and an ISP next to a username is a lot closer to where someone lives than “an IP address” suggests. The September policy didn’t mention location or ISP data at all. The current policy now does.

IP addresses are “linked to your Discord ID (not your username).” The breach report counts Discord user IDs and usernames for about 28 million accounts, and the rewritten policy now says usernames are stored at verification and tied to the user ID.

Browser details are “temporarily cached” and “deleted automatically.” The report lists about 25 million user-agent hashes that were copied, plus about 15 million VPN-detection records holding IP addresses and user agents that weren’t. That isn’t a temporary cache.

“Access is restricted to authorized system processes. No human can view your stored private data.” An administrator’s saved login and an admin-level cloud key were sitting on a server nobody was using. The affected database was reachable from the internet until Tellter closed it at 15:24 on the day of the attack, and its cache database ran on a third-party, internet-facing host until it was moved later that day. The new policy promises databases “reachable only through private networks.” That’s a good rule. It wasn’t the case on October 4.

“All personal data processed by Double Counter is … encrypted using AES-128 CBC symmetric encryption.” The report doesn’t say whether the copied IP records were encrypted, or whether the keys to read them were within the attacker’s reach. It treats them as exposed, and so should you. The emails and usernames that were published were plainly readable.

Kept for longer, and used for more, than verification needs

To catch an alt, a bot needs to check a new verification against earlier ones. That doesn’t obviously require keeping readable IP addresses, postal codes and usernames for years. Double Counter already stores user agents as one-way hashes; IP addresses could be matched the same way, and VPN or ISP checks can be done at the moment of verification without keeping the result next to a name.

Instead, the September policy kept IP addresses for 24 months after your last verification, so each new verification restarted the clock. The new policy adds up to 36 months for accounts the system has flagged. Version 1.9 of the incident report also mentioned a separate “cold storage” database of user data and IP addresses for about 58 million users, used by “some of our other processes.” It wasn’t touched. Version 2.0 no longer mentions it, and neither policy explains what it’s for or how its contents fit the retention limit.

The data was also put to a second use. From September 2024, Tellter sold subscriptions to Doogle, a search site where a paying subscriber could enter any Discord user ID and get back the accounts the system thought belonged to the same person, with a confidence rating. Its documentation describes a network of more than 40 million unique user IDs built from Double Counter’s verifications. Doogle never showed IP addresses, but it turned verification data into a paid lookup service, and it was opt-out: you were included unless you found the /privacy command and objected. Hiding your account from reverse searches only arrived in September 2025. About 840,000 of the leaked email addresses came from Doogle accounts. Tellter shut Doogle down on October 10, six days after the breach.

The published data adds to this. Payment records kept a full street address next to a Discord user ID, which ties an account most people treat as a pseudonym to a home. Marketing attribution, meaning how each customer found the product, was stored in the payment system’s customer metadata beside their billing details. And Tellter held hundreds of thousands of email marketing contacts, far more than running a verification bot needs; verification itself never asked for an email. None of these choices is rare for an online business, but together they put more about each person in one place than the service needed.

The verification page itself also carried ads. The September policy said it used Ezoic for interest-based advertising, with third-party cookies that may collect your IP address, device and browser details. The current policy lists Google AdSense on the same page. People who had to verify to join a community were also handing that information to ad networks.

How Tellter handled it

Some of the response was good, and it’s fair to say so:

• It cut off the attacker and restored the bot the same day, and audited 14 cloud projects for anything left behind.
• It published a detailed public timeline the next day, which is more than many larger companies manage.
• It notified France’s data protection authority, the CNIL, on October 5, inside the 72 hours the GDPR allows.
• It counted conservatively, treating whole tables as exposed when it couldn’t tell which rows left.
• It apologized, rotated its secrets, moved the bot token into a secret store, closed the database to the internet, filed a criminal complaint in Paris on October 21, and asked for published copies to be taken down.

Other parts fell short.

The first report understated what happened, for 16 days. Version 1.9, published October 5, said $7,316 had been charged, that “only three cards were charged in total” and that “no other customers were affected.” It told Atis customers “no action is needed.” Version 2.0 on October 21 corrected this to 40 charges against the cards of 11 customers, and disclosed for the first time that about 5,000 Doogle and Atis customers’ billing records had been copied and partly published. Have I Been Pwned had already noted subscriber names, countries and postcodes in the published data on October 7.

People were emailed 17 days later. Tellter says it began emailing everyone whose address was in the data on October 21. The GDPR asks companies to tell people “without undue delay” when a breach is likely to put them at high risk. Whether 17 days meets that is for the CNIL to decide. Until then, anyone who didn’t follow the news had no notice at all.

Most of the people affected won’t hear from Tellter at all. About 27 million accounts had IP and location data exposed, but only about a million email addresses were in the data. Verification never collected emails. The report describes no way of reaching everyone else beyond the public page itself. If you verified through Double Counter and never used its dashboard or Doogle, assume no one is going to tell you.

What isn’t known

• Which Metabase flaw was used, and whether a patch existed before October 4.
• Whether the copied IP records were encrypted, and if so whether the attacker could decrypt them.
• Whether the IP and location data has been published or sold. The portion published so far has no IP address field.
• Why the published Stripe export holds more than 21,000 unique customer emails when Tellter counts about 5,000 payment records.
• Who the attacker is.
• What the 58-million-user cold storage database holds, how old its records are, and why it’s kept.
• Whether the CNIL will open an investigation, and when Discord will let new servers install the bot again.

What you can do

1. Assume your IP address and rough location may be out there if you’ve ever verified through Double Counter. Many home connections get a new IP address from time to time, and restarting your router sometimes gets you a new one, though not always. Your city and internet provider don’t change that way.
2. Be wary of “re-verify” links and Double Counter messages. The attacker already used the bot to post invites once. Tellter says it never asks for passwords, tokens or payment by email or direct message, so anything that does is a scam.
3. Treat threats that mention your city or ISP calmly. That information may be from this breach, and it doesn’t mean someone has your address. Don’t engage; report the account to Discord and the server’s moderators.
4. Turn on two-factor authentication on Discord. Your password wasn’t in this breach, but leaked emails and usernames make targeted phishing easier.
5. If you were a Doogle or Atis customer, watch for fake refund or billing messages. Your name, billing address, card brand, expiry and last four digits were exposed, but not your full card number. Check your statements.
6. Ask for your data, or have it deleted. Use the bot’s /privacy command or write to gdpr@doublecounter.gg. If you aren’t satisfied with the answer, you can file a complaint with the CNIL (in French), the regulator for Tellter.
7. If you run a server, follow Tellter’s advice to delete any Double Counter message from October 4 between 12:00 and 16:30 UTC that invites people elsewhere, and check your audit log for the bot’s actions in that window. Then ask whether you need IP-based verification at all, and if you do, what the tool you pick keeps and for how long.

How Frame helps

Frame keeps a catalog of known breaches and lets you add the ones you know you were part of to a verified email. Frame shows what each one exposed, gives you a short checklist, and counts it in your exposure report. Automatic breach lookups aren’t live yet, so for now Have I Been Pwned is the quickest way to see whether your email is in the published Double Counter set. Frame’s email aliases also let you give bots, dashboards and other services their own address, so a leak like this one doesn’t point straight to your main inbox.

Sources

• Tellter SAS, Security incident report INC-2026-10-04, version 2.0, October 21, 2026
• Tellter SAS, Security incident report INC-2026-10-04, version 1.9 (Internet Archive copy), October 5, 2026
• Double Counter, Privacy Policy, as published before the breach (Internet Archive copy, September 23, 2026)
• Double Counter, Privacy Policy, current version, updated October 15, 2026
• Double Counter, Doogle documentation
• Doogle, Doogle has been discontinued, October 10, 2026
• Have I Been Pwned, Double Counter Data Breach, added October 7, 2026
• The Verge, Discord users’ data was exposed in a breach at server bot Double Counter, October 7, 2026
• Dexerto, Discord disables new bot installs after hack exposed millions of users’ IP addresses, October 7, 2026
• Frame’s analysis of the published data (totals only, no individual records), October 31, 2026