Thought Leadership
Attackers breached the Discord security bot through an old server, stealing IP addresses and location data and sending spam.
Double Counter, a verification bot used by Discord communities, has fallen victim to a cyberattack. According to the company, an attacker moved through its infrastructure for nearly six hours on October 4 and stole data linked to around 28 million Discord accounts. Servers use Double Counter to detect alternate and fake accounts. Discord itself was not attacked.
IP Addresses and Approximate Locations
The breach exposed Discord user IDs and usernames for around 28 million accounts. For approximately 27 million accounts, the attacker obtained IP addresses and approximate location data, including country, region, city, ZIP code and internet service provider. The stolen data also includes hashed user-agent values for around 25 million accounts, approximately one million email addresses and around 15 million VPN detection records containing IP addresses and user agents.
According to Double Counter, it has never stored Discord passwords. Payment card data was not present in the affected database. A separate database containing information on around 58 million users and another database containing behavioral data were not affected, the company said.
Attack Began Through an Old OVH Server
According to a report published by Double Counter, the attacker initially gained access to a decommissioned server from the company’s former hosting environment at OVH. Starting on October 3, the attacker probed the server using different VPN addresses. A vulnerability in a publicly accessible analytics tool allowed the attacker to obtain an administrator’s credentials and gain access to the cloud infrastructure.
From there, the attacker opened a shell in a running bot container and extracted its Discord token. This token allowed the attacker to impersonate the bot.
Spam Sent to 50 Communities
Using the stolen token, the attacker sent invitations to their own Discord server in Double Counter’s name to around 50 large communities. Most of the messages have since been deleted.
“Messages sent with the stolen token went directly to Discord without passing through our systems, so we identified the affected servers based on the reports we received and the bot’s own message history.”
Double Counter
Double Counter
The attacker also charged stored payment cards a total of US$7,316, primarily using a Double Counter corporate card with gradually increasing amounts of $1, $10, $100 and $1,000. Two customers were charged a combined $18 and have since received refunds. According to Double Counter, the attack has been contained and the service has been restored.
(Editorial Team)
