Data leak

Twitch Source Code and Creator Payout Leak β€” 125GB via Anonymous 4chan Post

πŸ“… 2021-10-04
Primary Source β†—

Incident Details

On October 6, 2021, an anonymous user posted a 125GB torrent to 4chan claiming it was a complete Twitch data dump intended to ‘foster more disruption and competition in the online video streaming space.’ The leak included: Twitch’s entire source code going back years; creator payout data showing the earnings of approximately 10,000 top Twitch streamers (the most viral element, revealing that top streamers earned millions annually); internal security tools; proprietary SDKs and AWS services used internally; the unreleased Amazon Game Studios title ‘Vapor’ (a Steam competitor); and internal tools and red-teaming documents. Notably, hashed user passwords and full credit card numbers were reportedly not included. Twitch confirmed the breach was real and attributed it to a server misconfiguration. The creator payout data was particularly controversial as it publicly revealed the financial earnings of Twitch streamers for the first time, affecting thousands of content creators who had kept their income private. Twitch (owned by Amazon) reset all stream keys as a precaution. The anonymous poster stated the 125GB was ‘part one,’ suggesting more data might be released. No subsequent major release occurred. The motivation appeared ideological rather than financial β€” the poster called Twitch a ‘disgusting cesspool’ and wanted to harm the platform. No individual was publicly identified or charged in connection with the breach.

Technical Details

Initial Attack Vector
Server misconfiguration β€” Twitch stated the data was exposed due to an error in a Twitch server configuration change; the specific nature of the misconfiguration was not detailed, but the attacker accessed and exfiltrated data from Twitch's internal Git repositories and infrastructure

Timeline

  1. 2021-10-04 Breach occurred
  2. 2021-10-06 Publicly disclosed
  3. 2021-10-06 Customers notified