Double Counter Discord Bot Breach Exposes 28 Million User Records On October 4, 2026, Double Counter, a security bot for Discord, disclosed a breach after attackers infiltrated its cloud infrastructure, exfiltrating 12 GB of database records and hijacking its bot token to spam unwanted invitations across 50 large Discord servers. The incident was contained by 19:19 the same day, with investigators confirming no backdoors remained in the 14 audited cloud projects. The attack originated from an old OVH server part of Double Counter’s former hosting setup that still hosted a publicly accessible Metabase analytics tool. Exploiting a flaw, the attacker forged an admin session, gaining access to stored credentials, including a cloud service-account key with admin rights and a saved command-line session. This allowed them to pivot into production systems undetected, as their activity mimicked legitimate user behavior. By 12:03, the attacker had added an SSH key, exported a database to a storage bucket, and accessed a bot container, exposing the Discord token. Though staff revoked the token at 13:39, the attacker quickly obtained the replacement, demonstrating the limitations of rotating a single secret while the underlying system remained compromised. They later changed the database admin password and exfiltrated records between 15:09 and 15:34, leveraging the stolen admin session even after the service-account key was revoked. Access was finally terminated at 17:55 after all compromised sessions were invalidated. The breach exposed 28 million Discord IDs and usernames, 27 million IP-address and location records, 25 million user-agent hashes, and 1 million unique email addresses though these datasets overlap, preventing an exact victim count. Have I Been Pwned later identified 275,000 unique emails in publicly leaked data, a subset of the full exposure. Notably, Discord passwords and payment card details were not compromised, and 58 million users in cold storage remained unaffected. However, a stolen Stripe key enabled $7,316 in fraudulent charges on a company card, with two affected customers refunded. In response, Double Counter shut down the old server, revoked all compromised credentials, deleted exposed webhooks, and migrated databases behind private networking. The bot now uses dedicated secret storage, with enhanced access logging and continuous monitoring to prevent future incidents. While the breach stemmed from legacy infrastructure, it underscores the risks of overlooked attack surfaces in cloud environments.