Twitch suffers data leakage; source code and payments to streamers are exposed

Twitch, the web’s most famous streaming video game platform, suffered a cyber attack early this Wednesday (6). An anonymous web surfer used 4chan, the famous imageboard-style community, to announce that the service has been “completely owned” (a term used by the hacker community to refer to the act of breaking into a computer system) by cybercriminals. Furthermore, a 128GB torrent file was made available for download as proof of the invasion.

The material in question would include, according to the advertisement itself, all source code for Twitch.tv and its mobile apps (including over 6,000 Git repositories and all commits since the company’s inception), various proprietary development kits (SDKs), internal red teaming tools of the company’s Security Operations Center and reports of payments to streamers from 2019. The collection would also include drafts of an Amazon platform to compete with Valve’s Steam.

The anonymous attacker did not attribute the maneuver to any known cybercriminal group, merely saying that the purpose of the invasion is to “promote more disruption and competition in the online video streaming market”, since the Twitch user community would, by nature, be “a disgusting toxic cesspool”. The mysterious attacker still teases: “Jeff Bezos paid $970 million for this, and we’re giving it away,” referring to Amazon’s 2014 purchase of Twitch at the quoted price.

Although the veracity of the leak was initially discussed, it didn’t take long for us to have confirmation that the attack was real. Troy Hunt, security researcher and creator of the famous leak crawler Have I Been Pwned?, compiled tweets from several professional Twitch users who reviewed the material and confirmed that earnings reports match their financial earnings perfectly. Personal and user data apparently are not part of the exhibition.

“We can confirm that a violation has occurred. Our teams are urgently working to understand the extent of it all. We will update the community as additional information becomes available. Thank you for supporting us,” said Twitch in an official statement.

Source: 4chan, Troy Hunt (Twitter), Twitch (Twitter), TheHack.