Double Counter data breach: what leaked and what to do
Double Counter (doublecounter.gg) had a data breach on 2026-10-04 affecting 274,922 accounts.
!Personal data leaked
Added to the catalogue 7 Oct 2026.
What leaked
- Email addresses
- Geographic locations
- Names
- Usernames
What happened
In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames. A small number of records belonging to paying subscribers whose purchases were processed via Stripe were also present and included names, countries and postcodes.
Description from Have I Been Pwned, in its words.
What to do
- Warn staff: emails, texts or calls quoting leaked details are not proof the sender is genuine.
- If card or bank details leaked, watch statements and tell the bank; if identity documents leaked, consider a credit ban or alert.
- Turn on two-factor sign-in on that service and on your email.
Common questions
What leaked in the Double Counter breach?
Email addresses, Geographic locations, Names, Usernames
When did the Double Counter breach happen?
The breach date is 2026-10-04; it was added to the public catalogue on 2026-10-07.
What should I do if my staff used this service?
Warn staff about emails, texts and calls quoting the leaked details, and watch for sign-in attempts on the services they use.
Was a staff address in this breach?
Check one address free, no storage. Breach Watch checks every staff address after each new breach.