The bot kept the addresses

The moderation bot is not Discord. The IP address it stored is still a location.

Reporting on Tellter’s own timeline says the attacker first got into an old server in the early hours of 4 October through a Metabase vulnerability, later pulled a cloud key and the bot token, and between mid-afternoon copied about 12 GB of tables. Service was restored the same evening on new credentials. The public note and a filing to France’s CNIL are dated 5 October. I am not walking the steps.

What they say left: Discord user IDs and usernames for about 28 million accounts. Roughly 27 million of those rows also carry a location and an internet provider. About a million email addresses. Discord passwords and card numbers are the fields they say were not in the copy. Around the same afternoon the bot posted invite spam into large servers. That spam is a symptom of the token. The table copy is the incident.

What an IP in a bot database is

It is not a Discord takeover, and it is not nothing. A user ID plus an IP plus a city is enough for someone who already dislikes a person in a server to stop guessing which town. The email, where it exists, is the account-recovery hook for whatever else that address opens. Tellter is the data controller in this telling. Discord the company is not the breached party just because the rows are Discord-shaped.

If you run a bot that “needs” an IP for anti-abuse, this is the bill for keeping it. If you are a person in that 28 million, assume the row is in more than one place by the time the CNIL email goes out. Rotating a Discord password does not move the IP that was already written down. The useful moves are the ones that assume the address and the town are known, and that treat a surprise login on the email in the row as the next page of the same file.

The token let them speak as the bot for an afternoon. The table is why the afternoon still matters.