Loading story…
Discord server protection service Double Counter disclosed a data breach on October 4, 2026, attributed to a vulnerability in the Metabase analytics tool. Attackers accessed a subset of the service’s data, and a subsequently published corpus contained approximately 275,000 unique email addresses, along with Discord usernames. Have I Been Pwned added the breach to its records on October 7.
The exposed data also included a small number of paying subscribers’ records containing names, countries, and postcodes, associated with purchases processed through Stripe; the reported incident does not establish a breach of Stripe itself. The combination of email addresses, Discord identities, and subscriber details creates opportunities for targeted phishing and impersonation. Affected users should be alert to messages posing as Double Counter or payment support, while organizations operating Metabase should review security updates and restrict access to analytics systems.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Double Counter disclosed the incident and stated that attackers had accessed a subset of its data, attributing the breach to a Metabase vulnerability.
Double Counter, a Discord server protection service, suffered a breach attributed to a vulnerability in the Metabase analytics tool. Attackers gained access to a subset of the service's data.
A subsequently published corpus contained approximately 275,000 unique email addresses and Discord usernames. It also exposed names, countries, and postcodes for a small number of paying subscribers whose purchases had been processed through Stripe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers gained unauthorized access to a third-party customer service system used by Discord, resulting in the exposure of sensitive user data. The breach, which occurred on September 20, 2025, did not compromise Discord’s core infrastructure but targeted a helpdesk provider that managed customer support and Trust and Safety interactions. The attackers obtained personally identifiable information, including real names, Discord usernames, email addresses, and IP addresses of users who had contacted Discord’s support teams. In addition to contact details, the breach exposed partial payment information, such as the last four digits of credit cards and payment types, as well as purchase history for some users. Notably, a subset of affected users had submitted government-issued identification documents, such as driver’s licenses and passports, for account appeals or age verification, and these scanned IDs were also accessed by the attackers. The attackers demanded a ransom from Discord, threatening to leak the stolen information if their demands were not met, indicating a financially motivated campaign. Discord responded by immediately revoking the support provider’s access to its ticketing system, launching an internal investigation, and engaging a leading computer forensics firm to assist with remediation. Law enforcement agencies were also notified and involved in the investigation. The company publicly disclosed the incident and notified affected users, emphasizing that full credit card numbers and account passwords were not compromised. The breach highlights the risks associated with storing sensitive data, such as government IDs, in third-party systems, especially as regulatory requirements push platforms to collect more personal information for age verification. Security experts note that customer support platforms often become attractive targets for cybercriminals due to the concentration of sensitive user data. The incident underscores the importance of minimizing data retention and ensuring that sensitive information is not stored longer than necessary in support systems. Discord’s experience mirrors previous breaches at other major platforms where helpdesk systems were exploited to access user data. The company’s swift response aimed to contain the breach and prevent further unauthorized access. The exposure of government-issued IDs is particularly concerning, as it increases the risk of identity theft for affected users. The breach serves as a cautionary tale for organizations relying on third-party vendors to handle sensitive customer interactions. Ongoing investigations are expected to provide further insights into the attackers’ methods and the full scope of the compromised data. Discord has committed to reviewing and strengthening its data handling and vendor management practices in the wake of the incident.
Jun 29, 2026
Cybersecurity researchers reported a major exposure at **IDMerit**, an AI-driven identity verification provider, after discovering an unsecured, internet-accessible **MongoDB** instance containing **over 3 billion records** (over 1TB). Exposed data reportedly included full names, addresses, dates of birth, national ID numbers, phone numbers, and email addresses; researchers estimated roughly **~1 billion** records contained sensitive data (with duplicates likely inflating the total). The dataset was described as global in scope, affecting individuals across **26 countries**, with large volumes attributed to the **US, Mexico, and the Philippines**, creating downstream risk for **identity fraud, account takeover, phishing, and SIM-swap** activity. Separately, Australian finance technology platform **youX** confirmed an **unauthorized third-party access** incident, after which a hacker claimed theft of data tied to **444,528** Australian borrowers and additional loan-application and identity data (including driver’s licence numbers, addresses, and credit/banking-related information), plus customer/staff details associated with broker organizations. **Substack** also confirmed unauthorized access to **limited user data** (including email addresses, phone numbers, and internal account metadata) that occurred in **October 2025** but was only identified on **Feb. 3, 2026**; Substack stated **passwords and payment card/financial data were not accessed**, but the extended detection gap raised concerns about monitoring and dwell time.
Jun 29, 2026
A 15.5 GB dataset allegedly sourced from Chess.com was posted for free on an underground forum, containing 7.3 million records and approximately 4.6–4.7 million unique email addresses. The records include usernames, names, countries, and Chess.com account-related information. Have I Been Pwned added the data to its breach corpus but assessed that it was likely collected by scraping publicly accessible Chess.com web or API data rather than by compromising protected Chess.com systems. About 99% of the email addresses had appeared in earlier breach datasets; nevertheless, the combined account details can enable convincing chess-themed phishing, impersonation, and fraud.
Sep 16, 2026