Discord Security Service Double Counter Compromised in Multi-Stage Attack

Double Counter, a Discord server protection tool, suffered a data breach on October 4 that exposed approximately 1 million email addresses and affected millions more user accounts with compromised Discord IDs and IP addresses. Attackers exploited a vulnerability in a legacy analytics server and maintained access for nearly six hours, during which they stole credentials to post malicious content and commit fraudulent charges. The company has since secured its systems, notified relevant authorities, and restored service without requiring user action.

The attack exploited a security gap in an outdated analytics platform that remained publicly accessible, allowing intruders to obtain cloud authentication credentials. Once inside Double Counter's infrastructure, the threat actors maintained their foothold for approximately six hours, during which they harvested user data at scale and compromised administrative credentials used to control the service's Discord bot functionality.

The incident affected both free and premium users differently. While all users faced potential exposure of Discord identifiers and network information, paying customers had additional personal details at risk including names and geographic information. Approximately 275,000 records have already surfaced on public breach databases, though the company estimates vastly larger exposure across its user base.