We Didn’t Need Discord Back in the Day

[Grumpitude]

Let’s get straight to the point. Attitude Gaming is deliberately moving away from Discord and embracing a website, forums and TeamSpeak instead. It might seem a little old-school in 2026, and I appreciate that it won’t be everyone’s cup of tea, so I want to explain why we’re taking this approach.

This isn’t about being different for the sake of it. It’s about the kind of community we want to build, the tools we want to use, and having greater control over our own little corner of the internet.

Bringing Back the Traditional Guild Atmosphere

One of my goals with Attitude Gaming is to recreate some of the atmosphere of the guild communities many of us remember from the mid-2000s. Back when guilds had their own websites, forums were where discussions happened, and being part of a community meant more than sitting in a Discord server.

As I mentioned in our Welcome to Attitude Gaming post, I’m an ’80s millennial. I’ve never particularly enjoyed the modern obsession with rapid-fire chat, endless notifications, emoji reactions and conversations that disappear into a scrolling wall of messages.

I’d rather have proper discussions, organised information and a community with an identity of its own. Somewhere you can write something meaningful, come back to it a week later, and actually find it again.

Discord is convenient, certainly, but convenience isn’t the only thing that matters when building a community.

And that brings me to another concern: privacy.

Discord and the Privacy Question

I work in tech and run a small tech company, so privacy, security and data handling are things I take seriously. Discord has plenty of useful features, but I’m uncomfortable with how much trust we have to place in a third-party platform to handle our conversations and personal information.

One important distinction: Discord does use encryption for data in transit, but its standard text messages and voice calls are not end-to-end encrypted. That means Discord, rather than just the people participating in a conversation, can technically access certain content. This is different from services where end-to-end encryption prevents the provider from reading the contents of communications.

That doesn’t automatically mean Discord is doing anything malicious with your messages. However, it does mean we’re relying on Discord’s security, policies and internal access controls to protect that information.

For me, that’s a meaningful distinction.

The Age Verification Controversy

A particularly concerning example is Discord’s third-party customer service security incident, disclosed in October 2025. The incident involved a provider used by Discord’s support team, and exposed sensitive information belonging to some users, including government ID images submitted during age-related appeals, alongside other customer support data.

This is precisely the sort of risk that concerns me about handing sensitive information to online services and their third-party providers. Even when a company has security measures in place, its wider network of contractors and suppliers can introduce additional risks.

It’s worth being clear that this was a breach involving a third-party service provider, rather than evidence that Discord’s entire database was compromised. Nevertheless, from a user’s perspective, the distinction offers limited comfort if sensitive information they supplied to the platform ends up exposed.

And this isn’t the only privacy concern worth discussing.

Who Has Access to Your Data?

Like most large online platforms, Discord’s privacy arrangements involve more than Discord itself. Depending on the circumstances, its policies allow information to be processed or shared with various organisations.

These include:

• Service providers and vendors: Companies that help operate the platform, provide customer support, process payments, or deliver other services. These relationships can be necessary, but they also introduce additional parties into the data-handling process.
• Analytics and measurement partners: Organisations that help measure usage, understand engagement and assess how people interact with the service. The information collected and how it is used depend on the specific arrangements and privacy settings.
• Connected third-party services: Linking accounts or authorising integrations can allow information to be exchanged between services, depending on the permissions granted.
• Law enforcement and government authorities: Discord may disclose information in response to valid legal processes and in other circumstances permitted by applicable law.
• Corporate affiliates and business successors: Information may be shared within a corporate group or transferred as part of certain business transactions, subject to the applicable privacy terms and legal requirements.

None of these practices is unique to Discord, and sharing information with a service provider doesn’t automatically mean that provider can access everything you do. However, the more services and organisations involved, the more complicated the overall privacy picture becomes.

I’d rather minimise the amount of information we hand over to third-party platforms wherever we reasonably can.

A Pattern Worth Paying Attention To

Discord has experienced several security and privacy incidents over the years. If you’re interested in looking into them yourself, here are some examples:

• Malicious packages targeting Discord authentication tokens – malware distributed through npm packages designed to steal Discord credentials and tokens.
• October 2025 third-party customer service security incident – Discord’s own account of the incident involving its customer service provider.
• The Spy.pet scraping controversy, April 2024 – a service that scraped and sold data collected from Discord users and servers.
• Third-party customer support breach disclosed in May 2023 – a support agent’s compromised account resulted in unauthorised access to user support information.
• MEE6 bot security concerns and NFT community compromises – reporting on incidents affecting projects that relied on Discord integrations.

These incidents differ in their causes, scope and severity. They don’t establish that every Discord user is at risk, nor do they mean that Discord itself was directly responsible for every compromise.

What they do demonstrate is that online security doesn’t stop at the platform itself. Third-party integrations, support providers, malicious software and the information users voluntarily share can all introduce risks.

My position is fairly simple: I don’t think we should automatically accept every platform as the default simply because everyone else uses it.

Why a Website, Forums and TeamSpeak?

So, what are we doing differently?

We’re building our community around tools that give us more control over how we communicate, organise ourselves and preserve our shared history.

Our Own Website and Forums

Our website is more than a place to post recruitment adverts. It’s intended to be the central hub for the Attitude Gaming community.

Because we control the website and its codebase, we can develop features around what our guild actually needs, rather than relying entirely on the priorities of an external platform.

That means having dedicated spaces for:

• Event sign-ups and raid organisation, with a clear overview of upcoming activities.
• Long-form discussions that don’t disappear into a busy chat feed.
• Guides, builds and shared resources that members can find when they need them.
• Guild announcements and progression updates that remain accessible.
• Community discussions and feedback that help shape the future of the guild.

Forums also give us something that instant messaging struggles with: a structured, searchable history of our community. Discussions can continue over days or weeks, useful information can be revisited, and new members can catch up without scrolling through hundreds of messages.

And, admittedly, there’s a healthy dose of nostalgia involved. I like the idea of having our own website, our own forums and our own identity, rather than being another server in somebody else’s ecosystem.

TeamSpeak for Voice Chat

For voice communication, we’re using TeamSpeak.

It’s a familiar, purpose-built voice communication platform that suits the way we want to play. We can organise channels around raids and general conversation without needing to turn our entire community into a permanent messaging feed.

TeamSpeak also offers features such as encrypted voice communications, depending on the server configuration and connection in use. Its lightweight client can be appealing to players who want voice chat without the additional features and background activity of a larger communication platform.

I’m not claiming TeamSpeak is magically immune to security issues, or that every TeamSpeak configuration provides identical protections. No software is perfect. But it gives us a voice-focused alternative that fits our needs.

Most importantly, we want TeamSpeak to be somewhere people actually hang out, not just a place to join five minutes before a raid and leave the second the final boss dies.

The conversations between encounters, the random nonsense, the laughs and the familiar voices are all part of the experience we’re trying to recreate.

Is This About Privacy or Nostalgia?

Honestly, it’s both.

I miss the days when guilds felt like their own little communities, with websites, forums, regular events and people who knew one another beyond their character names.

I also prefer having control over the services we rely on, reducing unnecessary third-party dependencies and being more deliberate about where our information goes.

Our website and forums aren’t a guarantee of perfect privacy, of course. We still have to maintain them properly, secure our accounts, keep software updated and handle any information we collect responsibly. Running our own infrastructure also means taking on responsibilities that a hosted platform would otherwise manage.

But I believe that owning more of our community infrastructure is worth the effort.

We can build the features we want, decide how our community is organised, and create something that belongs to Attitude Gaming rather than depending on a single commercial platform for everything.

Is This Approach for Everyone?

Probably not, and that’s fine.

Discord is popular for good reasons. It’s convenient, widely used and brings text, voice and integrations together in one place. I’m not expecting everyone to share my concerns or agree with every decision I’ve made.

But Attitude Gaming isn’t trying to appeal to absolutely everyone. We’re building a particular kind of guild for people who want a more traditional MMO community, enjoy proper discussions, appreciate a dedicated website and don’t mind using TeamSpeak for voice chat.

If you value community, privacy-conscious choices, old-school guild culture and playing games without turning every interaction into another engagement metric, you might feel right at home here.

Come and Join Us

If you like what we’re building, take a look at our About Attitude Gaming post to learn more about the guild.

You can create an account on our website, introduce yourself on the forums, join the guild and sign up for activities through our Event Schedule.

We’re building a community with its own identity, its own home and its own way of doing things.

No Discord required. Just a website, a forum, TeamSpeak, and a group of people who want to enjoy their games together.

Edited by Grumpitude on October 28th 2026 at 17:07

[Grumpitude]

Double Counter Data Breach Exposes Data Linked to 28 Million Discord Accounts

A major security breach at Double Counter, a popular Discord verification bot used by communities to identify alternate accounts, has exposed personal information associated with approximately 28 million Discord accounts.

According to a report by Cybernews, an attacker spent nearly six hours inside Double Counter’s infrastructure on 4 October, stealing large volumes of user data and taking control of the service’s Discord bot.

The incident raises serious questions about the amount of personal information collected by third-party Discord bots and the risks users face when these services are compromised.

What Discord user data was exposed?

The attacker reportedly accessed several databases containing information linked to millions of Discord accounts.

The compromised data reportedly includes:

• 28 million Discord accounts: User IDs and usernames.
• 27 million accounts: IP addresses and approximate location data, including country, region, city, postal code and internet service provider.
• 25 million accounts: User-agent hashes.
• 1 million accounts: Email addresses.
• 15 million VPN detection records: IP addresses and user-agent information.

Double Counter confirmed that it did not store Discord passwords and that no passwords were exposed in the incident. Payment card numbers were also not stored in the compromised database.

The company said a separate cold-storage database containing information on approximately 58 million users was held outside the affected infrastructure and was not accessed. Its behavioural data database was also stored separately and reportedly remained unaffected.

However, the absence of passwords does not eliminate the privacy risks. When usernames, IP addresses, approximate locations and other identifying information are combined, attackers may be able to build profiles of individual users, link their identities across different communities and target them with more convincing scams.

Attacker allegedly steals more than $7,000 through fraudulent card charges

The incident reportedly went beyond data theft. The attacker also exploited their access to make fraudulent charges against payment cards associated with the service.

According to reports, the attacker tested a series of increasingly large transactions against one of Double Counter’s own cards, charging $1, $10, $100 and $1,000.

The total fraudulent activity reportedly reached $7,316. Two additional charges, totalling $18, were made against customers, both of whom have since been refunded.

Double Counter stated that only three cards were charged in total and reiterated that stored card numbers were not exposed in the breach.

How was Double Counter compromised?

According to Double Counter’s account of the incident, the attack began with an abandoned server from the company’s previous OVH hosting environment.

Although the server was no longer connected to the live service, it reportedly provided the attacker with an entry point into the company’s wider infrastructure.

The reported sequence of events was as follows:

1. Initial reconnaissance: On 3 October, the attacker began probing the abandoned server using rotating VPN addresses.
2. Administrator credentials stolen: A vulnerability in a publicly exposed analytics tool was exploited, allowing the attacker to obtain an administrator’s credentials.
3. Cloud infrastructure accessed: The stolen credentials were then used to gain access to Double Counter’s cloud environment.
4. Discord bot compromised: The attacker opened a shell inside a running bot container and extracted its Discord authentication token, effectively taking control of the bot’s identity.
5. User data stolen: The attacker moved through the affected infrastructure and extracted data from compromised systems.

The incident highlights how neglected infrastructure and exposed administrative tools can undermine the security of an otherwise operational service. A server that is no longer actively used can still pose a serious risk if it remains accessible and insufficiently secured.

Compromised bot used to advertise attacker’s Discord server

After taking control of the bot, the attacker reportedly used its stolen authentication token to post invitations to their own Discord server across approximately 50 large communities that used Double Counter.

Because these messages were sent through the compromised bot, they appeared to come from Double Counter itself, potentially making them seem legitimate to unsuspecting members.

One of the largest communities reportedly targeted was Steal a Brainrot.

Double Counter said most of the malicious messages have since been removed by the company or the moderators of affected servers.

The company also explained that messages sent using the stolen token went directly to Discord rather than passing through its own systems. This meant staff had to identify affected servers through reports and the bot’s message history.

The incident illustrates another risk associated with third-party bots: compromising a trusted service can give attackers a way to reach members across numerous communities while appearing to act through a familiar, legitimate account.

Has Double Counter fixed the breach?

Double Counter says the attack has been contained and the service restored. The company has also stated that its separate cold-storage and behavioural data databases were not affected.

However, containing an attack does not undo the exposure of information that has already been stolen. Usernames, email addresses and IP addresses may remain useful to attackers long after the original vulnerability has been addressed.

Anyone who has interacted with Double Counter should be cautious about unexpected Discord invitations, suspicious direct messages and links claiming to come from trusted community services. Users should also be wary of messages that use familiar branding or appear to come from legitimate bots.

If you suspect your information may have been exposed, avoid clicking unsolicited links, review your Discord account’s security settings and enable multi-factor authentication where possible. Be particularly alert to phishing attempts that use personal or location-related information to appear more convincing.

The wider privacy risks of Discord bots

The Double Counter breach is a reminder that third-party verification bots can collect substantial amounts of information about the people who use them. Depending on how they operate, these services may be able to associate account identifiers with IP addresses, email addresses, location estimates and other technical information.

Before interacting with a verification bot, users should consider what information it collects, why that information is needed and whether the service has a clear explanation of how it protects and retains that data. Community administrators should also consider whether a bot’s benefits justify the information it gathers from their members.

The key issue is not simply whether Discord passwords were stolen. It is how much information a third-party service can accumulate about millions of people — and what happens when that service is compromised.

With approximately 28 million accounts reportedly affected, the Double Counter incident demonstrates the potential consequences of concentrating personal information within services operating across thousands of online communities. It is also a reminder that trusting a bot in a Discord server means placing some degree of trust in the organisation behind it, its infrastructure and its security practices.

Edited by Grumpitude on October 28th 2026 at 16:59

[Author]

Posts