Double Counter data breach: 274K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-10-07
In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames. A small number of records belonging to paying subscribers whose purchases were processed via Stripe were also present and included names, countries and postcodes. Exposed data: email addresses, geographic locations, names, usernames. The breach dates from Oct 4, 2026; Have I Been Pwned loaded it on Oct 7, 2026.
What to do
- If you had a Double Counter account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch
