The Double Counter Hack Exposed a Privacy Nightmare

Summary

The video investigates a breach of Double Counter, a Discord verification bot, and its related service, Doogle, which lets users search for Discord accounts and identify associated alternate accounts. The creator examines the hackers’ claims against a copy of the leaked database, user-submitted deletion receipts, Double Counter’s policies, and Discord’s developer rules.

What Was Exposed

The creator says the breach contained data associated with 23.6 million users, including Discord IDs and usernames, IP addresses and approximate locations, server verification history, and linked alternate accounts. Doogle records also included users’ email addresses. Leaked customer files exposed some paying customers’ full names and billing addresses.

The creator explains that combining these fields could let someone link Discord accounts, infer a user’s city, and build a more detailed profile. The data could be especially harmful to people using alternate accounts to separate identities or avoid harassment.

Claims About Deletion and Privacy

The investigation found evidence that Double Counter’s /privacy deletion command did not consistently remove users’ data. Among 132 people who contacted the creator, the creator says 72 had data retained in ways that appeared inconsistent with Double Counter’s own privacy policy. Nineteen reportedly still had personally identifying information, and 59 had Doogle data that had not been deleted.

The video notes an important caveat: users who verified with Double Counter again after deleting their data could have their information re-added.

The creator also found that Double Counter retained location information even when an IP address had been removed, and that Doogle data—including user IDs, usernames, and emails—could remain after a deletion request. The video argues that this raised potential GDPR concerns, while noting that the legal consequences would depend on the circumstances.

Doogle’s Data Use

The hackers alleged that Doogle data was sold to gambling and OSINT services. The creator found that a gambling-related site used Doogle’s API as a verification tool, but did not find evidence supporting the broader gambling allegation.

The creator did find that three applications from OSINT-related entities were approved for API access; two were reportedly connected to Telegram groups associated with swatting and extortion. The video emphasizes that OSINT tools can be used for legitimate investigations as well as doxing and harassment.

Security and Disclosure

According to the hackers, the intrusion involved an exposed or vulnerable Metabase system and access to Google Cloud resources, including database permissions and tokens. The creator describes the reported setup as poor security practice.

The hackers also demonstrated access to a staff panel that could display user information, which the creator says contradicted Double Counter’s claim that no human could view stored private data.

The creator criticizes Double Counter’s initial breach notice for being difficult to find, not clearly describing all exposed data, and not promptly contacting affected users. The creator says the hackers also leaked public customer information, including billing addresses.

The video condemns the hackers’ conduct as well: they allegedly shared personal data during a livestream and used threats and demands for payment, which the creator characterizes as extortion rather than responsible disclosure.

Discord’s Response and Outcome

The creator compares Double Counter’s practices with Discord’s developer policies on privacy, data retention, security, and sharing API data. After the creator reported findings to Discord, Double Counter began sending breach notices, updated its incident report and privacy policy, and discontinued Doogle.

The creator says Discord later allowed Double Counter to be added to servers again, interpreting the outcome as a limited penalty despite the findings.

The video ends by advising people who used Double Counter or Doogle to treat their data as potentially exposed, be cautious about suspicious messages or extortion attempts, and consider changing accounts if they face stalking. It also stresses that the hackers should not be treated as trustworthy simply because they uncovered security problems.

Reviews, Guides, or Tutorials

No product review or step-by-step tutorial is presented. The video does explain technical concepts such as Stripe secret API keys, database access, Discord verification records, hashing and fingerprints, and the potential uses and risks of OSINT tools.

Main Speakers and Sources

The video draws on the creator and investigator; hackers speaking in livestream excerpts and messages; statements and policies from Double Counter’s owner; Discord developer terms and policy documents; and users who shared deletion-request evidence with the creator.