Double Counter Breach Exposes 274,922 User Records via Metabase Vulnerability
What Happened – In October 2026 the Discord‑server protection service Double Counter disclosed that attackers exploited a vulnerability in its Metabase analytics platform. The breach gave the adversaries access to a data set that was later published, containing 274,922 unique email addresses, Discord usernames, geographic locations, and, for a small subset of paying customers, names, countries and postcodes.
Why It Matters for Trust & Control Assurance
- Highlights the risk of un‑monitored third‑party components; a continuous control‑assurance program would flag the Metabase flaw before it could be abused.
- Demonstrates the need for auditable evidence that vendor‑risk assessments, patch management, and vulnerability‑scanning are performed on a regular cadence.
- Provides a concrete example of why defensible documentation of remediation actions is essential for audit readiness.
Who Is Affected – SaaS providers in the tech/security space that embed third‑party analytics tools; their customers’ personal data (email, usernames, location) is exposed.
Recommended Actions
- Conduct an immediate inventory of all third‑party software (e.g., Metabase) and verify they are patched to the latest secure version.
- Deploy continuous vulnerability scanning and automated alerts for any newly disclosed CVEs affecting those components.
- Capture and retain evidence of vendor risk assessments, remediation timelines, and patch‑deployment logs for audit purposes.
Technical Notes – The attack vector was a vulnerability exploit in Metabase (specific CVE not disclosed). Exfiltrated data included email addresses, Discord usernames, geographic locations, and limited subscriber billing information processed via Stripe. Source: Have I Been Pwned – Double Counter breach