Twitch: Source code and payments leaked

[German]The complete website of the interactive live streaming service Twitch has probably become public in a data leak. An anonymous hacker posted a torrent link on the 4chan platform on Wednesday (6/10/2021). The torrent package, with a size of 125 GB, is said to contain the complete data (source code, payments to streamers, etc.) of the platform.

Twitch, available under Twitch.tv, is a live streaming video portal that belongs to Amazon and is primarily used to broadcast video games. The portal is the competitor to Steam, with most users coming from the US. Now, Twitch's crown jewels, so to speak, seem to have come under the wheels and been leaked..

The Twitch data leak

There were first hints of the data leak in the blog's discussion section – as well as via the following tweet. The website VGC has published more details about the data leak.

On VGC, the article says that an anonymous hacker claims to have leaked all of Twitch's source code and user payout data. A 125 GB torrent link was posted by this hacker on 4chan on Wednesday, which is said to contain the platform's source code, all payouts to the platform's streamers, etc. The hacker states that the leak is meant to "promote more disruption and competition in the online video streaming space" because "their community is a disgusting, toxic cesspool." Troy Hunt posted a screenshot of the 4chan post in the following tweet and gave an overview of the data leak's files on Github.

The site VGC confirms that the files mentioned on 4chan are publicly available for download by the anonymous hacker. Furthermore, the authors on VGC state that an anonymous company source shared that the data of this data leak is real and also contains the source code of the streaming platform operated by Amazon.

The leaked documents allegedly show that popular streamers such as Shroud, Nickmercs and DrLupo have earned millions by collaborating with the popular streaming platform Twitch. It is said that internally Twitch was informed about the hack along with the theft of the information, the unnamed source is quoted as saying. It is believed that the data was stolen as recently as Monday (Oct. 4, 2021).  The Verge has published some more information here and The Record has published some more information here about what else is said to be included in the data leak.

Users who have an account with Twitch should enable two-factor authentication, as there is a risk that the account could be taken over by the data leak.

Hack confirmed, details revealed

Addendum: Twitch has confirmed the data breach within the tweet below and this short post.

And Twitch has published the reason for the data breach.

We have learned that some data was exposed to the internet due to an error in a Twitch server configuration change that was subsequently accessed by a malicious third party. Our teams are working with urgency to investigate the incident.

As the investigation is ongoing, we are still in the process of understanding the impact in detail. We understand that this situation raises concerns, and we want to address some of those here while our investigation continues.