Tellter SAS, which runs the Discord server protection bot Double Counter, published an incident report (version 2.0, last updated 21 October 2026) on a multi-stage attack on 4 October 2026. The way in was an old server from its previous OVH hosting that was no longer used but still ran a publicly reachable self-hosted Metabase analytics instance; a Metabase vulnerability let the attacker forge an administrator session and reach the host.

The company does not name a CVE. That server held a cloud service-account key with administrator rights and an administrator's saved command-line session. With them the attacker added an SSH key, exported a database to a bucket, read the bot's Discord token from a running container, gave itself admin on the support server and posted links to its own Discord server in about 50 large servers using the bot. It read a replacement token within two minutes, deleted backups, changed the database admin password and copied about 12 GB before being cut off around 17:55; the service was restored at 19:19 with new credentials.

Exposed data includes IP-address records for alt detection (about 5.4 million copied in full) and a verified-users table (about 21.7 million rows, treated as wholly exposed though about 20% left). The attacker also used a stolen Stripe key for Tellter's separate Atis product to charge 'the cards saved by 11 existing customers of that product, one of them a company card of ours': 23 charges went through, for $7,331, of which '$7,322 was refunded the same day', and the remaining $9 has since been refunded.

According to the report, the copied data also includes de-duplicated email addresses for about 1.0 million accounts (Doogle accounts, about 840k, and Double Counter dashboard, server-manager, customer and advertiser contacts, about 240k), and payment-provider customer records for about 5,000 Doogle and Atis customers (name, email address, Discord ID and username, billing address, plan and payment history, card brand, expiry date and last four digits), marked 'Copied, partly published'.

Tellter says full card numbers and security codes were never accessible. It notified France's data protection authority, the CNIL, on 5 October, filed a criminal complaint with the Paris public prosecutor on 21 October, and since 21 October has been emailing everyone whose email address was in the affected data (about 1 million people).

Have I Been Pwned loaded the published data on 7 October: 274,922 unique email addresses with Discord usernames, plus names, countries and postcodes for a small number of paying subscribers. Discord passwords and stored card numbers were not exposed.

Correction (23 Oct 2026): this card previously said three cards were charged; Double Counter's report version 2.0 (21 October) says the saved cards of 11 customers were charged, for $7,331, almost all refunded the same day, and adds the copied email addresses and the Doogle customers' billing records.

Primary: Double Counter incident report.