Three days, or three and a half years

The gap between losing your data and being able to check that you lost it ran from three days to three and a half years this week. Both ends of that range are in the entries below, and what separates them is almost entirely whether the company said anything.

Who is in it

Taken in the order a British reader is likely to care about, which is not the order of their size. Double Counter is a Discord moderation service — the bot that makes you verify before you can post in a large server. If you have been through one of those gates, the Discord username and the email address you verified with may be in this one. It is the entry here that reaches ordinary consumers in any number.

CyrusOne operates data centres and Neogen sells food and animal safety testing. Neither dataset is a customer list in the way a shop has customers: both are corporate contact records — mailing lists, sales leads, employee files. You are in one of them if you work in those industries and once handed over a card. That is a narrow group, and nobody in it chose to be on the list.

Angel One is the largest here by a wide margin and the narrowest by reach. It is an Indian retail stockbroker, so a British reader is in it only if they hold an Indian broking account. If you do, this is the serious one on the page, and the rest of this piece is not really about you — the field list below is.

Everything added this week

Below is what the record gained in the seven days to 9 October. Where a figure is shown it counts account records rather than people: one person with three accounts at the same service appears three times. Treat it as the size of the pile, not the size of the crowd.

• Neogenneogen.com · 436,000 accounts · added 2026-10-09

  Exposed email addresses, employers, job titles, names and phone numbers.

• Angel Oneangelone.in · 6.8 million accounts · added 2026-10-07

  Exposed bank account numbers, dates of birth, email addresses, financial investments and ID document numbers.

• CyrusOnecyrusone.com · 373,000 accounts · added 2026-10-07

  Exposed email addresses, employers, job titles, names and phone numbers.

• Double Counterdoublecounter.gg · 275,000 accounts · added 2026-10-07

  Exposed email addresses, locations, names and usernames.

What was in it

No entry in this window lists a password among its exposed fields. The advice that normally follows a breach therefore applies to none of them, and we are not going to issue it anyway. What these carry is the layer underneath a password, which is the layer that does not reset.

• Home addresses and phone numbers appear in every entry here except the Discord one. Employers and job titles appear wherever the dataset was a company's own contact database rather than its customer list. None of those fields expire, and that combination — where you live, who you work for, what you do there — is what a people-search listing is assembled from.
• Angel One's list runs deeper: dates of birth, bank account numbers, Permanent Account Numbers — India's tax identity number — and portfolio holdings. The company told the Indian exchanges in April 2023 that the breach had no impact on client securities, funds or credentials. That is a statement about access, and it appears to have held. It is not a statement about disclosure, and the records are disclosed.
• Double Counter's is the lightest of them: email addresses, Discord usernames and coarse location, with names and postcodes only for the subset who had paid through Stripe. The company says Discord passwords and stored card details were not involved, and that the two fraudulent charges made during the incident were refunded.

Three days, or three and a half years

Double Counter was attacked on Sunday 4 October. It published an incident report naming the component that let the attacker in, the hours the access ran, and its estimate of what was copied. It was in the public record by Wednesday. Three days, start to finish.

CyrusOne and Neogen were both listed in August by the same extortion group, each with a deadline and a price. Neither has commented publicly. Their records arrived nine and six weeks after the losses respectively, once the group published the files and somebody outside both companies did the work of sorting them into searchable form.

Angel One reported a breach to the Indian exchanges in April 2023 and confirmed in July 2024 that data circulating online related to it. An affected person could first search their own email address against it on Wednesday — three and a half years after the loss. Nothing was being concealed for most of that time. The data simply had not been collected anywhere a member of the public could look.

That spread is worth holding onto, because it answers a question this product gets asked constantly. A scan that finds nothing today is a true statement about what is in the record today. This week's own rows show how far behind the event that statement can sit: at best three days, at worst longer than some of the accounts have existed.

What to do about the ones that cannot be reset

• If you were in a large Discord server on 4 October and the Double Counter bot posted an invitation to another server, that was not Double Counter. Its advice to server admins is to delete those messages; its advice to everyone whose address was exposed is to expect phishing, and that it never asks for passwords, tokens or payment by email or direct message.
• Treat a caller who already knows your employer, your job title and your address as unverified regardless. That combination is the entire value of a corporate contact dump, and it is what makes the call sound as though it came from inside.
• A leaked address is not a password. It does not need changing; it needs removing from the firms that resell it. That is a slower job, and nothing emails you a prompt to begin it.
• If you want the organisation held to account, the ICO takes complaints about how a company handled your personal information. It will not award you compensation — that is a matter for the company or a court.

We publish every holder we act against by name, so the claim can be checked rather than taken on trust. The coverage list shows which of them carries a home address.