The Permission You Never Actually Granted
Here is a quiet, uncomfortable truth about how most people end up inside a data breach: they rarely remember agreeing to anything. Double Counter is a third party Discord bot that server administrators install to screen out alt accounts, block raids, and flag suspicious VPN connections, the kind of background infrastructure that makes a large online community survivable. If you are a member of one of the thousands of Discord servers running it, you likely never clicked install yourself. An admin did that, on your behalf, and from that point forward Double Counter was quietly logging data about your account every time you showed up.
On October 4, 2026, an attacker spent roughly six and a half hours inside Double Counter's infrastructure, between noon and half past four in the afternoon UTC, and walked away with a copy of a database holding information on tens of millions of accounts that never chose to be there in the first place.
How the Attacker Actually Got In
The entry point was not Discord itself, and it was not even Double Counter's current infrastructure. According to the incident report Double Counter published, the attacker found a vulnerability in an analytics tool still running on the company's previous hosting setup, leftover infrastructure from an earlier chapter of the company's growth that nobody had fully decommissioned. From there, the attacker recovered credentials sitting on that old server and used them to reach Double Counter's current cloud infrastructure, the systems actually running in production.
Once inside, the attacker adapted in real time as Double Counter's team noticed the intrusion and began trying to contain it, a detail that suggests this was not an automated script running unattended but a person actively working the problem as defenders pushed back. They seized control of Double Counter's own Discord bot token and used it to post links to their own server across roughly 50 large Discord communities, turning a trusted, verified bot into a spam delivery mechanism in front of its own user base. They also reached one of the company's databases, copied about 12 gigabytes of data out, and along the way grabbed a stored payment key that let them run fraudulent charges.
What Actually Left the Building
The numbers Double Counter disclosed are worth sitting with for a moment, because they illustrate just how much a single background integration can end up knowing about you. Roughly 28 million accounts had their Discord user IDs and usernames exposed. About 27 million had IP addresses and coarse geolocation data taken. Around 25 million had user agent hashes, essentially a fingerprint of the device and browser used to access Discord, exposed as well. A smaller set, around one million accounts, had email addresses included.
The financial piece is smaller in scope but worth noting for what it reveals about how attackers monetize access once they have it. Using the stolen payment key, the attacker ran fraudulent charges totaling a little over seven thousand dollars across three cards, one belonging to Double Counter itself and two belonging to customers. Double Counter has stated that no stored card numbers were exposed, since the company does not directly hold that data itself, and that affected customers have been made whole.
Discord's Response, and the Limits of It
Discord was quick to clarify that its own core systems were never touched. That is accurate and worth taking at face value. Double Counter is a third party application that connects to Discord's platform through the same kind of bot API that powers thousands of other community tools, and Discord has stated that the access Double Counter's bot token carried did not include message content, passwords, or payment information. Discord has disabled new installations of the app while a joint investigation continues.
All of that is true, and none of it changes what already happened to the 28 million accounts whose data already left the building before anyone noticed. This is the structural problem with any platform that allows third party extensions, which is nearly every major platform people use daily. The host platform can legitimately say its own walls held. That is cold comfort to users whose data sat inside a trusted integration that the platform itself did not build, did not fully audit, and ultimately could not protect.
Why This Is Really About the Apps You Forgot You Approved
Most people could name, with real confidence, every major account they use regularly. Almost nobody could name every third party app, bot, or integration that has standing access to those accounts, often granted years ago, often by someone else, often for a feature that seemed harmless at the time. A server wide anti-cheat bot is a perfect example of exactly this blind spot. It is useful, it is nearly invisible once installed, and it was very likely never evaluated by most of the people whose data it was quietly collecting the entire time.
This is the same lesson this blog has returned to more than once this year in different forms, whether it was a Discord subpoena sweeping up people who never leaked anything or a CRM AI agent that could be hijacked through an ordinary contact form. The common thread is always the same. Data exposure increasingly happens through connections you did not personally make and permissions you did not personally grant, which means managing your own digital footprint has to include auditing what other people and other tools have connected on your behalf, not just what you yourself signed up for.
What to Actually Do About It
If you are active in Discord communities, take ten minutes to check which bots have access across the servers you spend the most time in, a list usually visible through a server's integrations settings, and raise the question with admins of servers you help run about whether every installed bot is still necessary and still actively maintained. For businesses running any platform that supports third party apps, bots, or plugins, whether that is Discord, Slack, a CRM, or anything else, build an actual inventory of what is connected and what access each connection actually carries, and revisit that inventory on a real schedule rather than only after a breach makes the question unavoidable.
At AetherGuard Technologies, mapping exactly this kind of forgotten, inherited access, the integrations and permissions nobody remembers granting, is a core part of both our personal security audits and our business security assessments, because the connections nobody is watching are consistently the ones that end up in a breach notification first.
