--- title: 'DoubleCounter (not Discord!) has had a major data breach' date: 2026-10-08 tags: [Discord] --- ## TL;DR (at the top) - DoubleCounter (not Discord) was breached - Millions of discord users' location data is now public - There's nothing you can do about this now - Don't submit to alt account checks or other identity checks. ## Introduction It feels like every time there's big news about Discord, everyone takes it upon themselves to @everyone with information they got from another server and never bothered to verify. On this particular occasion, press coverage isn't helping.From [CyberNews](https://cybernews.com/security/discord-user-data-breach/): "Discord user data breach hits 28 million accounts". [Insider Gaming](https://insider-gaming.com/discord-protection-bot-breach-exposes-accounts/) reports "Discord Provider Breach Exposes Up To 28 Million Accounts". [Instant Gaming News](https://news.instant-gaming.com/en/articles/22326-28-million-discord-accounts-have-been-affected-by-a-data-breach): "28 million Discord accounts have been affected by a data breach". All of these are misleading, placing blame on Discord instead of the real culprit: DoubleCounter. This post details what actually happened, verified by DoubleCounter's own reports. Apologies in advance for any formatting errors - I type this from a 2013 laptop with a half-functional network card while on a trip away from my usual setup. Miss Information works hard but damn it, I work harder. ## DoubleCounter was breached, not Discord What the above headlines, and many Discord messages, fail to mention is that Discord itself was not breached. In fact, Discord has made no statement about the breach, because it is largely nothing to do with them. The subject of the breach was [DoubleCounter](https://doublecounter.gg/), a bot which can be manually added to servers by moderators, and not directly affiliated with Discord itself. DoubleCounter claims to help server moderators "Block alt accounts, raids and VPNs"*. They do this by collecting information such as email addresses and IP addresses from users joining servers protected by it, and flagging accounts they believe to be suspicious and prevent them from participating in servers. \* Quick aside - VPNs are a legitimate privacy tool. While they can be used for nefarious purposes, treating them as inherently suspicious is actively harmful to those using the internet in unsafe political and domestic situations. The privacy implications of DoubleCounter have already been discussed, including coverage by YouTuber [No Text To Speech](https://www.youtube.com/watch?v=wVgwjFPwNYA). He makes a great case for why you shouldn't engage with any server that requires DoubleCounter. Notbaly, when you verify with DoubleCounter, it automatically figures out your location, sometimes down to the specific postcode, based on your connection to their website. They then cross-reference this, as well as information about your browser and sometimes your email address, with other accounts, to detect anyone who might be trying to circumvent a ban or direct a swarm of bot accounts. ## What actually happened According to [DoubleCounter's incident report](https://doublecounter.gg/blog/security-incident-october-2026) (published October 5th, 2026), hackers accessed their infrastructure for just under 6 hours on October 4th, 2026. They exfiltrated data including around 1 million email addresses, 25 million semi-anonymised browser and rough location data records, 27 million specific location data records (down to postal codes), and 28 million discord IDs and usernames. To re-emphasise: **Up to 27,000,000 users' precise location data was compromised.** Anyone subject to this now has their discord account and potentially their email address associated with their real-life street address. That's bad. DoubleCounter also noticed fraudulent charges of $7,316 against their own accounts, and a total of $18 against customers (that is, moderators who chose to use DoubleCounter). Notably, no customer payment information was leaked, so any current customer of DoubleCounter is safe, though should still seriously reconsider using their service. Finally, the attackers used the DoubleCounter discord bot to post links to their own server in around 50 servers using it. ## Users: What you can do If you have ever gone through DoubleCounter to access a server, at least some of your data has been exposed. There is nothing you can do about it. If you want to find out if you were affected, you can type your e-mail address into [haveibeenpwned.com](https://haveibeenpwned.com/). Note that this only works if your email address was compromised; it may well be that your account and location are linked together even if your email was not. In future, you should avoid going through checks supplied by DoubleCounter or any similar alt detection or age verification bot, because when you do, you create a massive risk to your sensitive information. ## Moderators: What you can do Quite simply, stop using DoubleCounter and similar products. Of course, you need to defend against raids and such, but asking all of your server members to give up their sensitive information to companies who demonstrably can't keep it safe is not the way forward. If you're already using DoubleCounter, I recommend removing it from your servers and rescinding all invites until you can find a moderation strategy that doesn't result in your users being doxxed. ## Conclusion Like a lot of people, I'm not particularly happy with Discord right now, between them shoving ads into the platform and trying to re-introduce global age verification. That said, it's important to direct our anger and criticism to the right platforms. On this particular occasion, Discord is innocent; it is DoubleCounter who is at fault. Though it's debatable whether the root cause here was a result of gross negligence on their part, the severity of this breach is damning, and should spell the end of their company. ## TL;DR (at the bottom) - DoubleCounter (not Discord) was breached - Millions of discord users' location data is now public - There's nothing you can do about this now - Don't submit to alt account checks or other identity checks.