Double Counter Bot Data Exposed: What Members Do?

Your student or gaming server used Double Counter for invite checks. News says the bot's data was copied, including emails and IPs. People ask whether Discord itself fell. You need a member notice and a phishing watch list, not a live spam war room.

On 7 October 2026, The Verge reported that Double Counter said hackers copied about 12GB of data including Discord usernames and user IDs, IP addresses, location data and email addresses, and that attackers also took control of the bot's Discord token. This evergreen article covers member password and phishing steps after that third-party exposure. For live spam from a compromised bot, see Discord server spammed by compromised bot. One wrong step can cost you the account, so know what you are doing before you start.

Last checked: 6 November 2026.

#Quick Answer

If you used Double Counter or joined servers that did, treat usernames, IDs, emails and IPs from the October 2026 report as exposed. Change your Discord password, enable two factor authentication, watch for phishing, and have admins remove the bot and check audit logs.

#Member Notice Template

#What Was Described as Exposed

#Password and Phishing Watch

1. Change your Discord password on a device you trust.
2. Turn on two factor authentication.
3. Change passwords on any email address reused with Discord.
4. Ignore DMs that demand urgent re-verification through a new site.
5. If you already tapped a phishing link, see Clicked a phishing link what to do.

Discord's Community Guidelines and Terms set user and service expectations. Discord Safety resources explain how to stay safer on the platform. Official help lives at Discord Support, not in a DM from a stranger.

#Admin Audit Log Window

Server admins should remove the affected bot, check audit logs for unexpected role changes or invites, and rotate webhook or bot tokens they control. Malaysian gaming and student servers that rely on invite verification bots should pick replacements carefully and limit which bots see email fields.

Remind members that Discord itself was not described as the breached company in the Verge report. The incident was framed as an attack on the bot operator.

#What Only Discord and the Bot Operator Can Decide

Discord decides platform enforcement. The bot operator decides how it notifies customers. Your part is password hygiene, phishing watch and server hygiene.

School club admins should notify a teacher sponsor when a verification bot exposure hits a student server.

Rotate any bot that requested email on join, not only Double Counter, until you trust the vendor's security note.

Members who reused Discord passwords on Steam or email should change those too, because phishing packs often try several services.

Tournament organisers should temporarily switch to manual invite approval until a replacement bot is vetted.

Parents of younger players should help turn on two factor authentication rather than sharing passwords.

If your email appears in a public dump search later, treat that as a fresh reason to rotate passwords again.

Admins should export ban lists and role maps before removing bots so permissions can be rebuilt cleanly.

Do not download random verifier APKs or desktop tools that claim to scan whether you were in the 12GB set.

Write down the exact on-screen wording before you screenshot so later appeals match what the platform showed on the day you acted.

Tell close contacts through another channel that your account may send odd links until the situation is stable.

Prefer official help URLs you type yourself rather than buttons inside unexpected emails or DMs.

Keep a simple timeline with Malaysia time stamps for every password change, appeal and public warning.

If a platform offers only a limited number of reviews, use them carefully and attach only evidence you can defend.

After access returns, review connected apps and remove anything you do not recognise before you resume normal posting.

Teams should nominate one owner for the case so staff do not file conflicting appeals from different logins.

Platform wording varies by app version and country, so quote your own notice rather than a screenshot from a friend.

If you work with an agency, give them read-only status updates instead of shared passwords while the case is open.

Avoid public arguments with attackers or impersonators; collect evidence quietly and report through official tools.

When a feature returns, test it with a harmless post before you resume paid campaigns or partner content.

Store recovery codes from two factor setup in a secure place you control, never in a public chat channel.

Third party bots sit in the trust chain of almost every large Discord. When one vendor reports a copy of emails and IPs, assume phishing will name your server for months.

Members should treat verify now DMs as hostile. Admins should publish the member notice template once and pin it.

Replace invite verification only after you read a new vendor's data policy. Schools and clubs should tell a responsible adult when student emails may have been included.

Members who received password reset mail they did not request should assume phishing and change passwords on a clean device.

Admins can temporarily raise verification to phone only while bot vendors respond.

Keep the Verge story link in the staff handbook so new moderators understand why the notice exists.

Encourage members to enable login alerts on email inboxes that may have been copied in the bot exposure.

Keep official help bookmarks in a password manager note so you open the right domain under stress.

If a step is unclear, stop and re-read the platform page before you invent a extra step.

Share only factual updates with partners until the account or Page status is stable again.

Write the date and time zone beside every screenshot so later reviews do not argue about sequence.

Prefer calm language in public posts; panic wording spreads faster than the fix.

Pin the member notice for at least a week so late joiners see it.

Admins should record which bot permissions were granted before removal so rebuilds stay minimal.

#When It Is Safer to Get Expert Help

Getting help is safer when admins already installed unknown replacement bots, when phishing led to a takeover, or when school or club data sits in the same email inbox.

If you are unsure about any step, or a community account matters to your organisation, having an experienced team check it is the safer choice. AwareXone does this work. See our account security page.

#When a Case Review Makes Sense

A case review helps when bot exposure and account takeovers overlap. We are a Malaysia-based team, independent of Discord, and we use only the official routes. We do not ask for your password or codes, and we cannot promise a result. See our trust page.

#Frequently Asked Questions