Double Counter breach: a forgotten server exposed 28 million users' data
Double Counter, the Discord verification bot used by more than 600,000 communities, disclosed on October 5, 2026 that attackers had breached its production cloud environment the day before. The entry point was not a sophisticated exploit: a decommissioned OVH server was still online, running an unpatched analytics tool. From there, attackers moved into the company’s Google Cloud infrastructure in under twelve hours.
The damage: a stolen Discord bot token, roughly 12 GB of copied database records tied to about 28 million Discord users, spam broadcasts to around 50 large Discord communities, and $7,316 in fraudulent card charges. All access was revoked the same day, and the founder confirmed that paying customers’ financial data stayed safe.
What makes this incident worth studying is the candor of the published postmortem. It reads as three familiar failure classes: incomplete decommissioning of legacy infrastructure, over-privileged service accounts using static long-lived keys, and secrets stored where running workloads can read them. The attackers even read a freshly rotated bot token within two minutes of its deployment, because the token was still reachable from inside compromised containers.
What to do
- Decommission completely. A “retired” server that is still online is not retired. Inventory every server you own and shut down what you no longer use.
- Scope and rotate service account keys. Over-privileged identities with long-lived static keys turned a single foothold into a cloud-wide incident.
- Keep secrets out of workload reach. A token that containers can read is a token an attacker can read. Short-lived credentials and tight scoping are the fix.
A forgotten machine running an unpatched tool is exactly what ZeroBreach’s server-layer audit is built to find: every server and connection inventoried, recurring scans that catch the unpatched software, and a decommissioning checklist so nothing you retired stays quietly online.