Report: Twitch Is Hacked And Its Source Code Is In The Wild [Update]

According to a report by VGC, an anonymous hacker has posted a 125GB torrent link containing, well, all of Twitch, including its source code and commit history going back to the start. The leak also contains streamers’ incomes since 2019, and information that suggests the Amazon-owned streaming platform’s Steam rival Vapor may really exist.

Update, 10/6/21, 11:30 a.m. ET: Twitch confirmed the hack on Twitter, but wrote that it still doesn’t know the extent of the breach:

We can confirm a breach has taken place. Our teams are working with urgency to understand the extent of this. We will update the community as soon as additional information is available. Thank you for bearing with us.

— Twitch (@Twitch) October 6, 2021

The download was posted to 4chan today, described by its unidentified source as “part one” of “an extremely poggers leak,” stating that it contains the following:

> Entirety of twitch.tv, with commit history going back to its early beginnings

> Mobile, desktop and video game console Twitch clients

> Various proprietary SDKs and internal AWS services used by Twitch

> Every other property that Twitch owns including IGDB and CurseForge

> An unreleased Steam competitor from Amazon Game Studios

> Twitch SOC internal red teaming tools (lol)

And, the poster notes, “Creator payout reports from 2019 until now. Find out how much your favorite streamer is really making!”

Calling Twitch a “disgusting toxic cesspool,” the given motivation for the leak is to, “foster more disruption and competition in the online video streaming space.” They add, “we have completely pwnd them.” They also include the #DoBetterTwitch hashtag.

Kotaku has verified that this is a working torrent, and VGC claims anonymous sources within Twitch have confirmed the data is legitimate. We’ve obviously contacted Twitch for further comment, but haven’t heard back at the time of publication.

The consequences for a leak like this can be huge. Clearly the first thing anyone who has a Twitch account should do is change their password immediately, and set up two-factor authentication. It’s also advised to reset your stream key to protect data.

But the longer-term issues will be far more complex. Just the financial information for big-name streamers getting out there will be hugely serious for Twitch, with figures in the millions of dollars.

Within the leaked data is reportedly information on Vapor, Amazon’s rumored rival to Steam, which would integrate a store into the Twitch platform. More information will likely come to light as the leak is pored over. And of course this is marked as “part one,” suggesting that much more information may have been compromised in the hack.

This all comes at a time of much tribulation for Twitch, with the #DoBetterTwitch/#TwitchDoBetter hashtags at the forefront of efforts by users to demand a better service from the platform, including boycotts to demand action over hate raids. Twitch seems to be making some positive moves, but then always finds a way to do something terrible too

We will keep you up to date with the consequences of the leak, which will likely be causing serious consternation at Amazon. As the hacker said on 4Chan, “Jeff Bezos paid $970 million for this, we’re giving it away FOR FREE.”