Update, 7th October: Twitch has now confirmed the breach. The company’s statement is as follows:
We have learned that some data was exposed to the internet due to an error in a Twitch server configuration change that was subsequently accessed by a malicious third party.
At this time, we have no indication that login credentials have been exposed. We are continuing to investigate.
Additionally, full credit card numbers are not stored by Twitch, so full credit card numbers were not exposed.
Original post:
Big, breaking news going around at the moment. If you have a Twitch account, you may wish to perform some security due diligence. There are multiple reports of the site being compromised. And they absolutely do mean compromised:
There’s still no independent verification from Twitch itself yet. However, multiple people have confirmed that the leak details, which include streamer revenue numbers, match what they have in fact generated.
What has happened?
A 128GB torrent was released on the 4chan message board. The poster claims it incorporates all of Twitch including
- Source code for desktop, mobile, and console clients
- 3 years of creator payouts
- Some form of unreleased Steam competitor
- Various bits of data on several Twitch properties
- Internal security tools
The leak is marked as “part 1”. The current data appears to contain nothing in the way of passwords or related data, but that potentially may be included in whatever comes next. This is something we may well find out from Twitch if and when it makes a statement.
In the meantime, we’d strongly suggest taking some proactive steps.
What should Twitch users do?
Log into your Twitch account and change your password to something else. If you’ve used the password on other services then you need to change them there too. Then enable two-factor authentication on Twitch, if you’re not already using it.
One small possibility against the leaking of passwords is there’s not been any visible “strange” activity from big name accounts. One would assume all sorts of dubious message shenanigans would follow in the wake of such a data grab. However, it’s possible that stolen passwords are being kept under lock and key until any such “Part 2” arrives.
This makes it all the more crucial to take some action now and start locking things down.
We’ll be updating this post with more information as we get it, so if you’re a Twitch user please feel free to check back every so often.
