One forgotten server was all it took. On Oct. 4, a hacker got into the systems behind Double Counter, a security bot used in more than 600,000 Discord communities. The way in was an old company server that had never been shut down and was running a tool with a known security vulnerability.
Discord has now temporarily disabled new installations of Double Counter. If you run a server and were planning to add it this week, you can’t.
What the attacker took
The numbers are bad. The stolen data was linked to approximately 28 million accounts and included usernames, IP addresses, approximate locations and ISP details.
About one million email addresses are believed to have been fully copied. And a stolen payment key was used to make charges totaling $7,316.
The data grab itself was quick. The attacker pulled 12GB out of the system in just 25 minutes.
Six hours inside the bot
The full takeover took roughly six hours. In that time the hacker gained control of Double Counter and used it to post invites to their own server in about 50 communities.
That’s what makes this one sting. Double Counter is a security bot, the tool server admins install to keep bad actors out. For a stretch, it was the bad actor’s advertising channel.
Where Discord stands
Discord pulled the plug on new installs only after the incident was publicly disclosed. The company also clarified that the attack didn’t target its own internal systems. The breach hit a third-party application.
That distinction matters to Discord, though it may not mean much to the 28 million accounts tied to the stolen data.
Discord is now working with the bot’s developers to figure out the full extent of the breach. Depending on what that turns up, further measures may be taken.
For now, Double Counter stays installed in its existing communities, but no new servers can add it. And the problem traces back to one old company server that nobody had shut down.
