Double Counter, a third-party Discord verification bot, suffered a data breach reported in October 2026. The available reporting confirms a public corpus containing about 275,000 unique email addresses and Discord usernames, but it does not establish that millions of users’ IP addresses were exposed. A separate report says roughly 28 million Discord usernames and IDs were involved; that is not a count of people or IP addresses.
What is Double Counter?
Double Counter is a third-party bot used by Discord servers to verify members and detect suspected alternate accounts, VPNs, and proxies. Its operator identifies itself as Tellter SAS. It is not a Discord-operated feature.
As an Amazon Associate I earn from qualifying purchases.
Double Counter’s privacy disclosure says its verification process handles a user’s Discord ID and username, IP address, and technical browser data. The company says server staff can see a verification outcome—such as whether someone is verified, flagged as an alt, or using a VPN—but cannot see the IP address itself. These are the company’s descriptions of its practices, not independent confirmation of how data was handled or secured.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What data does breach reporting confirm?
Have I Been Pwned lists a Double Counter breach in October 2026, attributed to a vulnerability in the Metabase analytics tool. Its listing, added October 7, 2026, reports 274.9k affected email addresses and describes a public corpus with 275,000 unique email addresses and Discord usernames. A small number of subscriber records also contained names, countries, and postcodes.
#1 Best Overall
These figures describe email addresses in the public corpus. They do not establish the number of IP records accessed or published.
Did millions of users’ IP addresses leak?
That claim is not confirmed by the available reporting. An AliasFleet report published October 7, 2026 says Double Counter’s incident report described about 12 GB of copied data and roughly 28 million Discord usernames and IDs. This is secondary reporting; the incident report itself was not available to verify those details here.
Even if the reported identifier figure is accurate, usernames and IDs are not interchangeable with unique people, IP addresses, or IP records. The available sources do not establish a confirmed total for exposed IP addresses. Double Counter says it processes IP addresses during verification, but that fact alone does not prove those addresses were included in the leaked data.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How could Double Counter process an IP address?
Double Counter says the IP address is processed when someone completes verification through its service. That is a separate interaction with a third-party verification system. It should not be described as Discord handing a user’s IP address to an ordinary bot through the standard bot API.
Discord’s safety guidance says, “Discord never shares your IP address with other users.” That statement concerns what Discord shares with other users; it does not establish what a third-party service receives when someone visits its verification page.
What should affected users do?
People who used Double Counter cannot determine from the published email-address count whether their IP address was exposed. Use practical account-security steps, while keeping in mind that they cannot retract information already copied or published.
- Be alert for targeted messages. Avoid unfamiliar links and unexpected requests for login details or verification codes. Report suspicious activity through Discord’s available reporting channels.
- Use a unique password. If you reused a password elsewhere, change it on those services too. A password manager can help generate and store distinct passwords.
- Enable two-factor authentication. This helps protect account access if a password is compromised; it does not remove leaked data.
- Ask about your Double Counter data. The company says users can request access to or deletion of information associated with their Discord ID through the bot’s
/privacycommand or its support channels. A deletion request cannot guarantee removal of copies already exposed outside the service.
What Discord’s rules do—and do not—mean
Discord’s Trust & Safety Team says that automating ordinary user accounts outside the OAuth2 or bot API—often called self-botting—is forbidden and can result in account termination. Discord has also described scraping public server information and self-bot activity as prohibited, with mitigations such as limiting widget data, stricter rate limits, and tighter permissions for downloading member lists.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Those rules and safeguards provide platform context; they do not establish what happened inside Double Counter’s infrastructure or confirm an IP-address total.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
