Double Counter, a bot thousands of Discord servers trust to keep raiders out, was breached on 4 October. The way in was a Metabase analytics tool left exposed on a legacy server. Cloud credentials from there opened the rest. The attacker held access for nearly six hours and copied about 12 GB: a million email addresses in full, plus IDs and coarse locations for tens of millions of accounts. A stolen bot token then posted malicious links into some 50 large servers. Tellter, the French operator, notified the CNIL the next day. Have I Been Pwned now carries 275,000 of the addresses. Discord has disabled new installs while it investigates. https://haveibeenpwned.com/Breach/DoubleCounter #CyberSecurity #InfoSec #DataBreach