Breaches and incidents
Double Counter / Tellter SAS (France, Discord verification bot): exposed Metabase on retired server led to cloud breach, 12 GB copied
Double Counter’s incident report says on 4 Oct 2026 an attacker copied about 12 GB from one of its databases (15:09 to 15:34).
- Disclosed
- Verification
- Checked against a primary source
What happened
- Double Counter’s incident report says on 4 Oct 2026 an attacker copied about 12 GB from one of its databases (15:09 to 15:34); data included Discord user IDs and usernames, IP addresses with coarse geolocation, email addresses and billing records of about 5,000 payment-provider customers. Since 21 Oct it has emailed everyone whose email was in the affected data, about 1 million people.
- Root cause: per the report, the entry point was “an old server from our previous OVH hosting setup” running a self-hosted Metabase that was “still running, and publicly reachable”; the attacker used credentials found there, including a service-account key, and added their own SSH key to the cloud project.
- No attacker named; the company says it is pursuing those responsible in France and the US.
- Access was cut, exposed credentials replaced and service restored at 19:19 on 4 Oct; the CNIL was notified on 5 Oct.