Twitch On Last Week's Security Breach: Passwords, Bank Info Not Exposed

Twitch issued an update today on its security breach from last week. In a statement, the streaming platform re-asserted that "the incident was a result of a server configuration change that allowed improper access by an unauthorized third party." Passwords were not compromised and Twitch is "confident that systems that store Twitch login credentials, which are hashed with bcrypt, were not accessed, nor were full credit card numbers or ACH / bank information."

Twitch called the impact "minimal," saying that it only affected a "small fraction" of users, and has taken further steps to secure its service. Notably, the hacker made available a list of Twitch payouts to creators over the past few years, revealing how many millions of dollars top streamers made.

When news broke of the breach last week, Twitch reset all stream keys, which may have affected your streaming experience, depending on what service you use. Personally, I reset my passwords for Twitch and Paypal (which I use to make purchases on Twitch) and already had two-factor authentication enabled. Your mileage may vary, but I'd suggest at least doing that much.

In the meantime, some details have surfaced about a major Twitch hack in 2014, which received the codename "Urgent Pizza" because of the copious amounts of pizza consumed by frazzled employees as they worked tirelessly to address the hack. Vice has the details of the incident, which was instigated by a "minimally skilled adversary" but still required long hours ("three weeks straight," according to one former employee) and led to Twitch needing "to rebuild much of its code infrastructure because the company eventually decided to assume most of its servers were compromised." The breach was not disclosed to users until six months after the incident, in March 2015.