Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
On October 4, 2026, an attacker stole Double Counter’s Discord bot token and used it to post invitations in about 50 Discord communities. Double Counter says the breach began through a vulnerable analytics tool on a retired server, and that some user data was copied or treated as exposed. Its report says Discord passwords and stored payment-card details were not exposed.
How the Double Counter breach happened
Double Counter’s incident report, published October 5, 2026, version 1.9, says the attacker first accessed a retired OVH server that was no longer connected to the operational service. A publicly reachable, self-hosted Metabase analytics tool was still running on that server. The company says a vulnerability in the tool allowed the attacker to forge an administrator session and access the host and credentials stored there.
Those credentials were then used to enter Double Counter’s cloud infrastructure. The attacker opened a shell in a running bot container and read its Discord token. Double Counter records 5 hours and 51 minutes of attacker activity in its cloud, from 12:03 to 17:54 UTC on October 4. That is the company’s cloud-activity window, not necessarily the full period of probing: its account says access to the retired host began the prior day. Double Counter says it restored service with new credentials at 19:19 UTC, after cutting off access and auditing for a backdoor. Read Double Counter’s incident report.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What the stolen Discord bot token was used for
The token let the attacker send messages as Double Counter’s bot, including links to an attacker-controlled Discord server. The company says it identified posts in about 50 large servers that used the service, and that it or community moderators deleted substantially all of them. Double Counter’s support server was also affected: the attacker’s account received administrator rights and roughly 15 roles, and invitations were posted through two webhooks.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Double Counter says messages sent with the stolen token went directly to Discord rather than passing through its own systems. That helps explain why the company identified affected communities using reports and the bot’s message history. Cybernews’s October 8 summary also describes the bot takeover and repeats that explanation, but Double Counter’s report provides the incident details. Cybernews’s report.
What Double Counter user data was exposed
Double Counter says about 12 GB of data was copied from a database. Its report separates data it says was copied from records that were only partly copied and therefore treated as exposed because the company could not determine which rows left the system:
| Data category | Company-reported scope and status |
|---|---|
| Discord user IDs and usernames | About 28 million accounts; partly copied and treated as exposed. |
| IP addresses and coarse location fields, including country, region, city, postal code and ISP | About 27 million accounts; partly copied and treated as exposed. |
| User-agent hashes | About 25 million accounts; copied. |
| Email addresses | About 1 million; copied, in the report’s combined approximate total. |
| VPN-detection records | About 15 million; not copied. |
These are the company’s estimates, not independently verified population counts. Double Counter says a separate cold-storage database covering approximately 58 million users and a separate behavioral-data database were not affected. The company’s report does not establish that every record in the partly copied categories was taken. Double Counter’s data-scope details.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Was your Discord password or card number exposed?
Double Counter says it never held Discord passwords and that stored card numbers were not exposed. The reported data exposure involved identifiers, IP and coarse-location information, user-agent hashes, and email addresses—not Discord login credentials or stored payment-card numbers.
The payment fraud was a separate issue involving a stolen payment-provider key for another product account. Double Counter itemizes $7,316 in fraudulent charges against one company card, plus two customer charges of $3 and $15. It says the two customer charges, totaling $18, were fully refunded, and that only three cards were charged. Cybernews’s headline compresses this into “steal from credit cards”; the company’s itemization makes clear that customers were not charged $7,316 and that card numbers were not stolen. The company’s payment-fraud account; Cybernews’s summary.
What Discord server administrators should do
Double Counter advises server administrators to remove any message sent by its bot on October 4 between 12:00 and 16:30 UTC that invites members to another server. Administrators should also review audit logs for bot actions in that period.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Find Double Counter bot messages from October 4 between 12:00 and 16:30 UTC that invite members to another server.
- Delete suspicious invitation messages; do not follow or redistribute the links.
- Review the server’s audit logs for bot actions during that window and investigate changes you do not recognize.
What Discord members and affected customers should do
For ordinary Discord members, Double Counter says no account change is needed. Do not join a server advertised in an unexpected Double Counter message. Members who completed verification between 13:39 and 14:49 UTC but did not receive a role should verify again.
Double Counter separately warns users of Doogle, its advertisers, and API customers that their email addresses were exposed and advises them to expect phishing attempts. Be cautious with unexpected messages or emails that ask for credentials, payment, or other sensitive information. The company’s guidance does not call for every Discord member to reset a password or replace a payment card.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How Double Counter says it responded
The company says it disabled and deleted the compromised service-account key, revoked administrator sessions, removed the attacker’s SSH key, shut down the retired server, and reset the bot token. It also says it deleted potentially exposed Discord webhooks, restricted database access, moved a cache database to a private cloud network, rotated exposed secrets, and audited 14 cloud projects for persistence.
Rank #4
- PHISHING-RESISTANT 2FA: Cryptographically binds to real domains, making phishing attacks impossible unlike SMS codes or authenticator apps.
- 3-SIDE CAPACITIVE TOUCH: Tap the end, left, or right side to authenticate, so it works in any orientation or crowded USB port.
- MULTI-COLOR LED INDICATOR: Blue means ready, blinking blue means tap now, green means success, and red means error for instant status feedback.
- IP68 WATERPROOF & BATTERY-FREE: Crush-resistant one-piece construction survives daily carry on a keychain or in a bag for years without any batteries.
- UNIVERSAL COMPATIBILITY: Works with Google, Microsoft, Apple, GitHub, AWS, and any FIDO2 / U2F / WebAuthn service, storing up to 100 passkeys.
Double Counter says it found no backdoor, enabled logging for secret reads, and added alerts and monitoring. These are the company’s reported actions and findings; the incident report does not present them as an independent forensic audit. It also says its report may be updated as the investigation concludes.
What is known—and what is not
The company’s account describes a chain from an exposed analytics tool on a retired server to stored credentials, cloud access, theft of a bot token, and spam messages in Discord communities. Its data and remediation figures are company-reported. The sources available do not identify the attacker, establish a motive, or provide separate independent forensic verification. Cybernews’s October 8 article is a shorter secondary account; for exact data categories, charges, and response steps, Double Counter’s October 5 report is the fuller source.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
