Threat intel

Double Counter, a Discord bot that verifies new members and blocks alternate accounts, was breached on October 4. The attacker spent 5 hours and 51 minutes inside the cloud systems of Tellter SAS, the French company that runs it, copied about 12 GB of database tables, took the bot's Discord token and used it to post invites in about 50 large servers. Tellter treats Discord user IDs and usernames for about 28 million accounts, and IP addresses with coarse location for about 27 million, as exposed. About 1 million email addresses were copied.

Discord says its own systems were not breached, and it has disabled new installs of the app while it works out the scope with Tellter. The bot claims more than 600,000 servers. If your community uses it, or any verification bot that logs member IP addresses, the data those bots hold and the permissions they keep are the part to review this week.

How it works

An anti-alt bot has a narrow job. When someone joins a server, the bot sends them to a verification page. That page records their IP address and browser details and compares them with everyone else who has verified, so a banned user who comes back on a second account gets flagged. The side effect is a large database linking Discord IDs to IP addresses, cities and internet providers, across hundreds of thousands of communities.

The way in had nothing to do with Discord. According to Tellter's incident report, a retired OVH server from the bot's old hosting setup was still online. It was no longer connected to the live service, but it ran a self-hosted copy of Metabase, an open source analytics dashboard, reachable from the internet. A vulnerability in that Metabase instance let the attacker forge an administrator session. Tellter has not named a CVE or the Metabase version, and secondary reports note the same gap.

The retired server still held a cloud service-account key with administrator rights and an administrator's saved command-line session. With those, the attacker logged in to production at 12:03 UTC as a legitimate identity. No new account was created, which is why the activity did not stand out at first. At 12:26 the attacker opened a shell in a running bot container and read the bot token from it.

A Discord bot token is the bot's password. Whoever holds it can act as the bot in every server that installed it, with whatever permissions each server granted. From 13:30 the attacker used it to post invites to their own server in about 50 large communities, including "Steal a Brainrot", and to give their own account Administrator rights on Tellter's support server. When staff banned that account, the bot was used to unban it.

What the attacker did

Tellter reset the token at 13:39. The attacker read the replacement within minutes of it going in, because they still held the cloud credentials that could read wherever the new token was stored.

Between 15:09 and 15:34 the attacker copied about 12 GB of database tables. That 25 minute window is why some outlets describe the theft as quick and others say the attacker was inside for almost six hours: both are right, the copy was one part of a longer session. Tellter spotted the intrusion while the copy ran and moved the databases off the internet, but the attacker still had other stolen credentials and stayed active for more than two hours.

The attacker also found a Stripe payment key for Atis, a separate Tellter product. Later that afternoon they ran test charges of $1, $10, $100 and $1,000 against a company card, $7,316 in total. Tellter says two small charges on customers were refunded and no stored card numbers were exposed. The last attacker activity was at 17:54, and the service came back with new credentials at 19:19.

Besides the IDs, IP addresses and coarse location (country, region, city, postal code and internet provider), Tellter lists about 25 million user-agent hashes, the browser fingerprints it uses to spot alternate accounts. It says VPN detection logs were not copied, and that its behavioural data and a cold-storage database sit outside the affected infrastructure.

The figures are Tellter's own estimates, based on table sizes and the order in which the copy tool read them. The main table of verified members' IP addresses was only partly copied when access was cut, and because Tellter cannot tell which rows left it treats the whole set as exposed. Of the roughly 1 million emails, about 840,000 belong to users of Doogle, another Tellter service, and about 240,000 to dashboard users, server managers, customers and advertisers. Members who only verified through the bot are mostly not in the email set.

A smaller set has already gone public. Have I Been Pwned added the breach on October 7 with 274,922 email addresses, alongside Discord usernames, plus names, countries and postcodes for some paying Stripe customers. Digital Citizen reports the same leak as about 275,000 emails. The public figure is well below the operator's count of copied emails, so more could surface later.

What to do

For server admins who use Double Counter:

1. Search your channels for Double Counter messages posted on October 4 between 12:00 and 16:30 UTC that invite people to another server, and delete them. Tellter gives this window in its report.
2. Open Server Settings, then Audit Log, and filter by the Double Counter bot user for the same window. Look for role changes, unbans, new webhooks or channel edits you did not make.
3. Tell members that the invites were not from your staff, and that Tellter and your moderators will not ask for passwords, tokens or payment in a direct message.

For every community, whatever bots it runs:

• Go to Server Settings, then Integrations, and list each bot. Remove the ones nobody uses. For the rest, take away Administrator and grant only what the bot needs; a verification bot needs Manage Roles, and its role should sit just above the role it assigns.
• Check which webhooks exist on the same Integrations page and delete any you do not recognise. A webhook URL posts messages without a token and survives a bot token reset.
• Before adding a verification bot, read what it stores. If it logs member IP addresses and city, that data now exists outside your control for as long as the vendor keeps it.

For members: Discord passwords were not involved, because Double Counter never received them. Expect phishing aimed at your Discord username if you used Doogle or a Tellter dashboard, and do not join servers promoted by unexpected bot messages. You can check your email at haveibeenpwned.com. If you verified between 13:39 and 14:49 UTC on October 4 and never got your role, verify again.

For teams that run bots

Every step that mattered here used something left in place before the attack. A retired server should hold no live credentials, and decommissioning means revoking its keys and sessions, not just removing it from the load balancer. Internal tools such as Metabase, Grafana and Jupyter belong behind a VPN or an identity-aware proxy, never on a public address.

The bot token sat in a container the attacker could open, and a long-lived service-account key with administrator rights sat on a forgotten disk. Keep bot tokens in a secret manager with read access logged, use short-lived workload identity in place of exported keys, and alert on new SSH keys or bucket exports in the cloud audit log. When you respond, revoke the attacker's access first and rotate secrets second; Tellter's first token reset failed for exactly that reason. In the Discord Developer Portal, the Bot page has a Reset Token button that invalidates the old token straight away.

If you want a second look at what your bots and internal dashboards expose, our attack surface management work finds forgotten servers like this one, and our cloud and Kubernetes security reviews cover service-account keys and secret storage. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Double Counter security incident report, Have I Been Pwned: Double Counter, Dexerto, GIGAZINE, Digital Citizen, Twisted Voxel, Cybernews.