[UPDATED] Twitch Suffers Major Data Breach, Includes Source Code And Payout Information

Ubiquitous streaming platform Twitch has suffered a major data breach, which news sources are describing as including source code and user payout information. An anonymous hacker leaked the code onto 4chan today, and Twitch has confirmed the data as being authentic.

We can confirm a breach has taken place. Our teams are working with urgency to understand the extent of this. We will update the community as soon as additional information is available. Thank you for bearing with us.

— Twitch (@Twitch) October 6, 2021

The hacker said that they leaked the info because Twitch's "community is also a disgusting toxic cesspool" and wished "to foster more disruption and competition in the online video streaming space." Twitch has been under fire for the past several months for the proliferation of "hate raids" on the platform, where concerted groups raid a (usually minority) streamer's chat to post racist or other toxic messages. Just last week, Twitch implemented measures to try and combat those types of attacks.

Video Game Chronicle described the extent of the information that's now publicly available as "the entirety of Twitch’s source code, creator payout reports from 2019, Proprietary SDKs and internal AWS services used by Twitch and more."

We'll update this article as more information becomes available. In the meantime, if you haven't done so already, change your Twitch password, as well as any important accounts -- like PayPal or whatever else you use for donations and bit purchases -- that it has access to.

UPDATE, Oct. 7: Twitch announced that it has reset all stream keys, which may or may not disrupt your streaming experience, depending on which software you use. Twitch teams are "working with urgency to investigate the incident" but the company claimed that there are "no indication that login credentials have been exposed" and that "full credit card numbers are not stored by Twitch, so full credit card numbers were not exposed."

UPDATE, Oct 8: A "do not ban" list has surfaced on the subreddit of streamer Asmongold, mentioning several well-known streamers, as well as other popular channels and Twitch staff. These include Twitch CEO Emmett Shear's "sarbandia" account, which includes the comment "do not ban for literally any reason," as well as some users who should be escalated to higher-ups in case discipline is warranted.

Other accounts have "reason"s listed, which we think means that they are reasons not to ban that streamer. Notably, DJWheat, who sports gray hair has the "underage" reason, which is believed to be applied because he sometimes puts his children on his stream and may have been previously reported for being underage himself, either by ignorant or malicious users. For similar reasons "shartqueefa" has an "inappropriate username" tag.