A Discord bot you never installed was holding 27 million IP addresses

Plenty of Discord servers run a bot called Double Counter. It exists to stop people sneaking back in on a spare account after being banned, and the way it does that is by recording your IP address when you join. It sits in more than 600,000 communities. Almost nobody who has been checked by it chose to install it.

On 4 October someone got into Double Counter's systems through an analytics tool still running on a server left over from an old hosting setup. Credentials found there opened the live cloud infrastructure. The intruder spent close to six hours inside and copied about 12 GB. The haul: roughly 28 million Discord user IDs and usernames, around 27 million IP addresses with country, region, city, postal code and internet provider attached, some 25 million browser fingerprint hashes, and about a million email addresses. They also took the bot's own Discord token and used it to post invites to their own server in around 50 large communities, and ran up 7,316 dollars on three stolen payment cards.

Discord's own systems were not touched and no Discord passwords were involved, since Double Counter never held any. Discord has disabled new installs of the app while it works out the full scope. Double Counter's advice is to delete any direct messages from accounts carrying its branding and be wary of server invitations you did not expect.

There is nothing to reset here, which is the frustrating part: the data is a map of where you live and what you browse with, and it is out. What you can still control is how much is sitting on your own machine. Tendvane's privacy and accounts check goes through the settings and sign-ins on your PC and tells you which ones are handing out more than they need to.