blog.murasama.net
Yet Another Discord Data Breach
Once again, the leaking of Discord personal user information has taken place. This one is related to a Discord bot called Double Counter which provides server security protection. The company that develops this bot has been accused of selling user data in the past (publishing the data on a pay for access site known as Doogle)
The data breach happened on October 4th and was attributed to a vulnerability in the Metabase analytics tool. Around 1 million user email addresses are affected along with databases of Discord IDs, usernames, IP addresses, and location data for **up to 28 million users** that was copied by the hackers.
Double Counter mentioned that attackers had gained access to a subset of its data which contained 275,000 unique email addresses and Discord usernames that ended up being publicly published. A small number of this data was for paying subscribers (via Stripe) and included their names, countries, and postal codes.
While Double Counter provided a detailed rundown of the incident, none of this provides any resolution for the users whose information was publicly leaked. This is why I wrote before that when push comes to shove, when the issue happens with a 3rd party vendor/service like this, good luck with seeing any level of accountability to the end users actually affected.
Once I learned about this latest breach, I immediately began taking steps again to deactivate my account (as I’ve written prior, I have been off/on about remaining on the platform especially with their push for age verification; I had last decided to significantly reduce the time spent on it).
Sure, while this wasn’t a leak by Discord itself, the point still stands that a 3rd party (service or vendor) can be breached and leak out significant amounts of personal information where both parties should be held accountable whenever such incidents of this magnitude takes place.
Discord has acknowledged the breach, has disabled any new installs of the bot, and is working with Double Counter to further learn about the extent of the leak. As a result, it is too early to see if Discord will take action against Double Counter. Until there is more information about this whole incident, I will be off the platform.