Metabase Vulnerability Exposes 275k Email Addresses and Discord Usernames from Double Counter
What Happened — In October 2026, Double Counter, a Discord server‑protection SaaS, disclosed a breach caused by an unpatched vulnerability in the Metabase analytics platform it used. Attackers accessed a subset of the service’s data and later published a corpus containing roughly 275 000 unique email addresses, Discord usernames, and limited subscriber details (names, countries, postcodes).
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of undiscovered weaknesses in third‑party components, a scenario continuous control‑assurance programs aim to detect through vendor‑risk monitoring and evidence collection.
- Demonstrating up‑to‑date security reviews of all dependencies provides a defensible audit trail that satisfies multiple framework objectives (e.g., NIST CSF Identify and Protect functions).
- Prompt remediation and user‑focused actions (password reset, MFA) are essential to maintain the integrity of the organization’s access‑control posture.
Who Is Affected – SaaS providers serving online communities, Discord server administrators, and the 275 k end‑users whose credentials were exposed.
Recommended Actions
- Conduct an immediate inventory of all third‑party services (e.g., analytics, logging) and verify they are patched to the latest secure versions.
- Integrate continuous monitoring of vendor security advisories into your risk‑management workflow and retain evidence for audit readiness.
- Notify affected users, enforce password changes, and require two‑factor authentication where possible.
Technical Notes – The breach stemmed from a known vulnerability in Metabase (specific CVE not disclosed publicly). Exploited data included email addresses, Discord usernames, names, geographic locations, and limited payment‑related fields for paying subscribers. Source: Have I Been Pwned – Double Counter Breach