28 Million Discord Accounts Had Their IP Addresses and Locations Leaked in a Bot Breach

You Were Tracked Without Knowing It

You joined a Discord server to talk about your hobby, your startup, or your favorite game. You never installed anything. You never signed a privacy policy. But a bot running in that server was quietly logging your IP address every time you connected. That data now sits in the hands of whoever breached Double Counter on October 3 and 4, 2026.

This is not a story about a company you trusted being careless. It is a story about a system where you never got to trust anyone in the first place.

What Is Double Counter, and Why Was It in Your Server?

Double Counter is a verification and anti-spam bot used in thousands of Discord servers. Server admins add it to cut down on duplicate accounts and bot raids. It works by prompting new members to verify through a web link, capturing their IP address and geolocation in the process.

Here is the part most people miss. When a server admin adds a bot, every member of that server becomes subject to whatever data the bot collects. You have no vote. You receive no notice. You just show up to chat and the bot starts logging.

How Did the Attackers Get In?

The breach did not start with Discord itself. Attackers found a forgotten analytics server at OVH, a cloud hosting provider, running unpatched Metabase software. Metabase is a common data visualization tool. The specific vulnerability let attackers forge admin credentials without knowing any real password.

From there, they used that initial foothold to pivot into Double Counter's broader cloud infrastructure. Within roughly six hours, they had reached live bot data and pulled approximately 12 GB of records before being cut off.

Six hours. That is a lunch break. That is how long it took to go from a forgotten test server to tens of millions of people's location data.

The Numbers

Approximately 28 million Discord account records were exposed in the breach. The breakdown is significant.

• Around 27 million accounts had Discord usernames, user IDs, IP addresses, and coarse geolocation exposed, city, region, country, postal code, and ISP
• About 275,000 unique email addresses were publicly released
• A smaller set of paying subscriber records also included full names and postcodes sourced from Stripe, the payment processor Double Counter used for premium features

Coarse geolocation from an IP address sounds vague. In practice it is not. City plus ISP plus postal code plus timestamp puts most people within a few blocks of their home. For anyone who connected to Discord from home, that data is a close approximation of their address.

Why Should You Care If You Have Nothing to Hide?

Your IP address and location tell people where you live, when you are home, and what internet provider you use. Combined with your Discord username, that is enough for targeted harassment, phishing, or SIM-swap attacks. It is enough for a stalker to narrow down a neighborhood. It is enough for a scammer to build a convincing fake support call.

None of the 28 million people affected opted into this. That is the detail that matters.

What to Do Right Now

1. Check if your data was exposed. Visit Have I Been Pwned (haveibeenpwned.com) and enter your email addresses. The Double Counter breach data will surface there as it is indexed. Check every email you have ever associated with Discord.

2. Change your Discord password. Do it now, even if you feel unaffected. Use a unique password you do not use anywhere else. A password manager makes this easy.

3. Enable two-factor authentication on Discord. Go to User Settings, then Privacy and Safety, then enable 2FA with an authenticator app. SMS-based 2FA is better than nothing but an authenticator app is significantly harder to attack.

4. Audit the servers you are in. You cannot see every bot a server admin has added. But you can leave servers you no longer actively use. Fewer servers means a smaller surface area for this exact problem.

5. Consider a VPN for everyday browsing. A VPN masks your real IP address from bots and third-party services. It will not undo what was already collected, but it limits future exposure. Reputable paid options exist; free VPNs often have their own data practices worth reading carefully.

6. Freeze your credit. If your name and postcode were in the paying subscriber records, a credit freeze at Equifax, Experian, and TransUnion costs nothing and blocks new accounts being opened in your name.

7. Watch for targeted phishing. Attackers who have your username, ISP, and rough location can write convincing fake emails that reference your city or ISP by name. Be skeptical of any unexpected messages asking you to log in, verify an account, or confirm a payment.

The Systemic Problem No One Is Talking About

Discord's own security did not fail here. The platform itself was not breached. But that framing lets a bigger issue hide in the background.

Platforms like Discord have created an ecosystem where third-party bots operate with real permissions on real user data, added unilaterally by server admins, with no disclosure requirement to the people actually affected. A single admin decision, "let's add this anti-spam bot", can expose every member of a community to data collection they never agreed to, stored on infrastructure they will never see, by a company they may never have heard of.

The breach at Double Counter is not an anomaly. It is a demonstration of what was always possible. Every bot in every server you have ever joined is a potential version of this story.

Do this now:

• Check haveibeenpwned.com with every email tied to Discord
• Turn on 2FA with an authenticator app
• Leave Discord servers you no longer use
• Change your Discord password to something unique

Sources

• cybernews.com
• talkesport.com