Key information
The third-party security service Double Counter recently suffered a deliberate, multi-stage cyberattack. Hackers maintained access to the service's infrastructure for nearly six hours, resulting in the theft of sensitive user information. Discord confirmed it was not directly breached, though the incident impacts users of the platform who utilized the security bot.
The breach resulted in the exposure of approximately 1 million email addresses. Additionally, databases containing Discord IDs, usernames, IP addresses, and location data for up to 28 million users were reportedly copied. According to Have I Been Pwned, 275,000 of the stolen email addresses and usernames have already been published publicly.
Double Counter functions as a moderation tool designed to identify alt accounts and prevent server raids. The service has previously faced criticism regarding its data collection practices and allegations of selling user information. This incident marks another significant security failure involving a third-party provider connected to Discord, following a similar breach involving a customer service partner last year.
In response to the incident, Discord has disabled new installations of the Double Counter application. The company stated it is currently collaborating with the service provider to determine the full extent of the data exposure and will implement further actions as necessary.
