Double Counter Breach: A Forgotten Metabase Server and a Discord Bot

Double Counter is a third-party Discord bot that helps server owners detect alternate accounts and verify users. According to reports from Dexerto and other outlets, an attacker on October 4, 2026 exploited a Metabase analytics instance running on a legacy server that was still publicly reachable. That access exposed cloud credentials, and the attacker was inside for just under six hours.

Reports describe roughly 12 GB of database records copied. Data types reportedly include Discord user IDs and usernames, IP addresses with coarse location and ISP data, hashed user agents, some email addresses, and for some paying subscribers, names, countries, and postcodes from payment records. Double Counter said no passwords or stored card numbers were exposed.

Secondary reports citing Double Counter's disclosure describe data covering about 28 million account identifiers and around 1 million emails. The HIBP service (haveibeenpwned.com), which added the breach on October 7, lists 274,922 accounts in the publicly leaked corpus. The difference between operator figures and the public leak had not been reconciled publicly.

According to reports, the attacker also obtained the bot's Discord token and used it to post invites in around 50 large servers. Reports also describe fraudulent charges made with a stolen payment-processor API key, which is a separate abuse of the same access rather than exposure of subscribers' card details. Dexerto reported that Discord disabled new installations of the bot.

Coverage describing a Discord breach in October 2026 refers to this third-party bot. Discord's own systems were not reported as compromised. Users who never added or interacted with servers using Double Counter would not be in this dataset.

The entry point was a retired server still running an internet-reachable analytics tool. Asset inventories that track every running instance, decommissioning checklists that confirm shutdown, and external attack surface scans that flag unexpected services would have caught it.

Business intelligence tools such as Metabase connect directly to production databases and often store credentials. They deserve the same patching, authentication, and network restrictions as the databases themselves. Exposing them publicly, even temporarily, creates a direct path to data.

Access to one system yielded cloud credentials. Store secrets in managed vaults, scope credentials narrowly, avoid long-lived keys on servers, and rotate keys when systems are retired.

A bot token can post across every server the bot is in. Rotate tokens on suspicion, restrict bot permissions to what is needed, and monitor for unusual posting activity.

According to secondary reports, Double Counter disabled compromised credentials, rotated secrets, moved databases to private networks, and notified France's data protection authority. Users can check exposure through the HIBP service (haveibeenpwned.com).

The attacker's identity, how many users' emails were affected in total, and whether further data will be leaked had not been established publicly.

Before retiring a server, confirm DNS records are removed, firewall rules closed, instances terminated, credentials revoked, backups and snapshots handled, and monitoring updated. Then scan from the outside to confirm nothing still answers. This incident shows what happens when one step is missed.

Six hours inside cloud infrastructure leaves traces: new sessions with stolen credentials, unusual database export volumes, and access from unfamiliar addresses. Cloud audit logs with alerts on credential use from new locations, and database egress monitoring, can shorten the window considerably.

Server owners who used Double Counter should review its permissions, consider whether they still need it, and warn members about possible phishing using their usernames or server memberships. Members whose emails appear in the HIBP service (haveibeenpwned.com) should change any reused passwords and enable multi-factor authentication on Discord.

Exposed analytics and admin tools appear repeatedly in breaches. The same week, Poppins Payroll attributed its own breach to a vulnerability in a vendor's Metabase instance, according to its notification letters. Internet-facing BI tools should be assumed to be actively targeted.

Inventory every server, restrict BI tools, vault and rotate secrets, scope bot tokens, and scan your external surface from the outside.

Reports say some subscribers' names, countries, and postcodes from payment records were exposed, but not stored card numbers. Payment processors typically hold card data, which limits exposure, but billing metadata can still aid fraud and phishing.