TL;DR: Two separate incidents matter. In October 2025 Discord said a third-party customer service provider was breached, exposing names, usernames, emails, IP addresses, support messages, limited billing details and around 70,000 government ID photos of users who had contacted support. In October 2026 Double Counter, a third-party Discord bot, was breached and about 275,000 email addresses and usernames were published. Discord passwords and full card numbers were not involved in either.
What happened in the October 2025 Discord breach?
On October 3, 2025, Discord announced that an unauthorised party had got into one of its third-party customer service providers. Discord said its own systems were not breached. The vendor was widely reported to be 5CA, a customer support firm, which denied its own systems were hacked. A group calling itself Scattered Lapsus$ Hunters claimed the attack and tried to extort Discord.
Only people who had contacted Discord's Customer Support or Trust & Safety teams were affected. Discord listed the data that may have been exposed:
- Name, Discord username, email and other contact details given to support
- Limited billing data: payment type, last four digits of the card, purchase history
- IP addresses
- Messages with support agents
- Government ID images for about 70,000 users worldwide, submitted for age-verification appeals
Discord said full card numbers, CVV codes, passwords and messages outside of support were not involved.
What happened in the October 2026 Double Counter breach?
Double Counter is a popular bot that many Discord servers use to block alternate accounts. It is run by a separate company, not Discord. According to Have I Been Pwned, attackers used a weakness in an analytics tool called Metabase to reach part of its data in October 2026. About 275,000 unique email addresses were later published with Discord usernames. A small number of paying subscribers also had names, countries and postcodes exposed.
If you ever verified in a server that uses Double Counter, your email may be in this set even if you never contacted Discord support.
How to check if you were affected
- 2025 support breach: Discord emailed affected users from noreply@discord.com and said the email would state whether an ID image was involved. Search your inbox (and spam) for it. Discord said it would not phone anyone about this.
- 2026 Double Counter breach: check your email in a breach lookup. Our free email exposure check runs it against known breaches in about 30 seconds.
- Ignore DMs or emails claiming to be “Discord Trust & Safety” asking you to log in or verify. That is how breach data is usually turned into account theft. Our explainer on what a real breach notification email looks like helps you tell the difference.
Why this breach still matters
Your Discord password was not taken, so why worry? Because the leaked pieces fit together. An email, a username, a real name and an IP address are enough to link your gaming identity to your real one. That is the starting point for doxxing, targeted phishing and harassment, which already happen a lot on gaming platforms. If your ID photo was exposed, the risk is higher, since an ID image can be reused to open accounts or pass weak verification checks elsewhere.
We have seen the same pattern with the Twitch data breach: the leak itself is only the first step, and the real damage comes later from what people do with it.
What to do if you were affected
- Turn on two-factor authentication in Discord (User Settings, My Account) using an authenticator app, not SMS.
- Change your password if you reused your Discord password anywhere else. See what to do when a password leaks, and how combolists turn reused passwords into account takeovers.
- If your ID was exposed, watch for accounts opened in your name and consider a credit freeze. In the US, our guide to reporting identity theft to the FTC covers the steps.
- Check your card statement. The last four digits alone can't be used to charge you, but they make fake “billing problem” messages more convincing.
- Lock down what's public: hide your real name, connected accounts and server list from strangers. If someone has already posted your details, read what to do about doxxing.
- If your account was taken over, follow our hacked gaming account recovery steps.
Frequently Asked Questions
Was there a Discord data breach?
Yes. In October 2025 Discord disclosed that a third-party customer service provider was breached, exposing data of users who had contacted support, including about 70,000 government ID images. Separately, the third-party bot Double Counter was breached in October 2026.
Were Discord passwords leaked?
No. Discord said passwords, authentication data, full card numbers and CVV codes were not involved in the 2025 incident. The Double Counter breach exposed emails, usernames and a few subscriber names and locations, not Discord passwords.
How do I know if my ID was leaked in the Discord breach?
Discord emailed affected users from noreply@discord.com and said the email would say whether a government ID image was accessed. Discord said it would not contact anyone by phone.
Is Double Counter part of Discord?
No. Double Counter is a third-party bot that Discord servers can add. Its breach affected people who verified through it, not every Discord user.
What should I do after the Discord data leak?
Turn on app-based two-factor authentication, change any reused password, ignore unexpected verify-your-account messages, and if your ID was exposed, watch for new accounts opened in your name.
Sources
- Discord: Update on a Security Incident Involving Third-Party Customer Service
- Bitdefender: Discord data breach, 5CA and 70,000 IDs
- Have I Been Pwned: Double Counter data breach