Stolen Twitch source code, creator payment data revealed in apparent data leak

Source code underpinning the live streaming service Twitch has reportedly leaked, exposing information about some company plans and payment data from popular accounts on the service.

Twitch, a subsidiary of Amazon, is a popular service that broadcasts esports, live music and other events to audiences that have numbered millions at a time.

An anonymous user of the message board 4chan — home to hackers and trolls alike — posted a 125-gigabyte torrent file that they allege includes all of Twitch’s code, including information about internal security tools, three years of payment history to Twitch “creators” and data related to proprietary software. The poster hinted that more details would be forthcoming, with the stated goal of “foster[ing] more user disruption and competition in the online video streaming space,” as the Video Game Chronicle first reported on Wednesday.

In a statement, Twitch confirmed a breach had occurred.

“Our teams are working with urgency to understand the extent of this,” a spokesperson said in an email. “We will update the community as soon as additional information is available. Thank you for bearing with us.”

Twitch streamers earn revenue from a variety of methods, from enlisting followers in paid subscriptions and earning sponsorships from video game brands to generating advertising revenue from the company itself. The high-profile nature of their work — the most popular accounts have more than 10 million followers — makes the streamers particularly attractive targets for attackers, tweeted Rachel Tobac, the chief executive of SocialProof Security, an anti-social engineering firm.

“In cases like this it doesn’t hurt to turn on [multi-factor authentication] and update password,” she continued.

The incident is the latest headache at Twitch. The company recently announced verification tools aimed at combating harassment on the site after viewers heaped abuse on streamers, particularly creators from minority communities. Twitch has struggled to rein in so-called hate raids, in which one user sends an army of bots to another streamer, overwhelming their page with hateful messages.

Discussions around the issue were loud enough for the campaigns #DoBetterTwitch and #ADayOffTwitch to trend on social media in recent weeks.

Update, Oct. 6: This story was updated to include a statement from Twitch.