Twitch, the live-streaming platform owned by Amazon, has suffered a huge data breach exposing the service’s source code, the income of its biggest stars and other sensitive information.
The breach was posted by an anonymous user on message board 4chan, a popular forum for hackers. The post alluded to more leaks in future, referring to the 125GB data dump as “part one”.
As well as confidential earnings data for its streamers going back to 2019, the breach was also said to contain details of “Vapor” — an as-yet unannounced competitor to Steam, the PC gaming store.
Other details included the full source code for its platform and software clients, documentation related to internal security systems and testing, and data from other Twitch-owned properties such as the Indie Game Database.
“We can confirm a breach has taken place,” Twitch said on Twitter on Wednesday. “Our teams are working with urgency to understand the extent of this. We will update the community as soon as additional information is available. Thank you for bearing with us.”
A spokesperson did not respond to requests for further comment. Amazon did not offer any statement.
Amazon acquired the site, formerly known as Justin.tv, in a $970m deal in 2014. It was one of the group’s biggest acquisitions at the time, and its first significant push into the games industry.
On 4chan, the anonymous poster remarked: “Jeff Bezos paid $970m for this, we’re giving it away FOR FREE.”
Like competitor YouTube, Twitch’s highest earners can earn more than $1m a year in revenue from advertising and subscriptions, as well as one-off tips from appreciative viewers. The site averages 35m daily active users, the company said during a recent earnings call. Amazon does not disclose Twitch’s revenues.
Several streamers cross-referenced details in the leak with their own account information, confirming that the dollar amounts found in the breach matched up with their actual earnings.
Details of the earnings of top streamers were a hot topic of discussion on the platform in the hours following the breach.
Ryan Morrison, an agent to several high-profile streamers, said: “I think most people who were paying attention to the space are not surprised by any numbers leaked today. It shows the potential opportunity for streamers and that there really isn’t a ceiling for what you can do nowadays as a content creator.”
Scott Hellyer, a streamer who has used the platform for more than 9 years, was among those affected, telling the FT: “People are going to be harassed.”
He added: “I really hope that no major personal info (full names, emails, address, phone number, banking info) gets out in the rumoured next part of the leak.”
The leak does not appear to contain personal information — such as email addresses or passwords — about users.
Hours after the leak surfaced, Hellyer said streamers had been left in the dark about the implications of the breach, other than a prompt to change passwords.
“No email, nothing in the Partner Discord server,” he said. “Everyone is just waiting to see what they are going to say. Lots of nervous people.”