HighBreach
Discord Users’ Data Exposed in Security Bot Double Counter Security Breach
Cyber Security News·Source published ·1 min read
What happened?
Double Counter, a Discord security bot, has disclosed a breach that exposed user data after an attacker broke into its cloud systems on October 4, 2026. Attackers copied about 12 GB of database records, and the stolen bot token was used to post unwanted invitations across roughly 50 large Discord servers. According to Double Counter’s official incident report, the attack is contained and service was restored at 19:19. Investigators audited 14 cloud projects and found no backdoors. The breach involved the bot provider’s infrastructure, not a confirmed compromise of Discord itself.
Key details
- Attackers exfiltrated about 12 GB of data and used the bot token to send invites to ~50 Discord servers.
- A stolen Stripe key was used to make $7,316 in fraudulent charges on a separate Atis account, with two charges later refunded.
- Response actions included shutting down the old server, revoking access, rotating credentials, deleting webhooks and moving databases behind private networking.
Affected
- A cloud service‑account key with administrator rights was stolen.
Fixes and mitigations
- Old server was shut down and all cloud access was revoked.
What to look for
- Attacker added an SSH key, exported the database to a bucket and opened a shell in the bot container.
- New Discord token accessed within two minutes after replacement indicates compromise.
- Database administrator password was changed and records were copied later in the day.
- Use of a stolen Stripe key to generate fraudulent charges was observed.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.