Twitch hack: data breach exposes sensitive information

The Amazon-owned gaming platform Twitch has suffered a data breach that experts have called a “highly targeted attack”.

Twitch on Wednesday confirmed it suffered a breach, and said its teams were working to understand its extent.

The breach has revealed a large trove of sensitive data, including Twitch’s entire source code and several years of payout information on the service’s most popular streamers, according to video game news platform Video Games Chronicle, which first reported the news of the hack.

This level of hack would “send a shudder down any hardened infosec professional”, Archie Agarwal, founder and CEO at New Jersey cybersecurity firm ThreatModeler, told the Guardian.

“This is as bad as it could possibly be,” he said. “How on earth did someone exfiltrate 125GB of the most sensitive data imaginable without tripping a single alarm?”

The hacker posted the leak to the online forum 4chan and said they carried it out to “foster more disruption and competition in the online video streaming space”, according to Video Games Chronicle.

Twitch’s parent company, Amazon, did not immediately respond to the Guardian’s request for comment.

Although it appears the hack directly targeted Twitch rather than its users, the breach will almost certainly have swept up user information. Users will have to take precautions, including changing their account credentials and making sure they don’t use the same combination of credentials to access other services online, experts said.

Hank Schless of the San Francisco security firm Lookout said that in many major breaches, hackers use a phishing campaign to obtain employee credentials and gain access to sensitive data. He stressed the massive nature of the breach.

“It’s not just one service or data type that was leaked,” said Schless. “It spans almost every aspect of the Twitch platform, including incredibly private proprietary data.”

The hack could have major implications for the popularity of Twitch, which has more than 51 million users. Its top users have raked in millions of followers, and the breach has now showed just how much they’ve made from it.

According to advertising analysts at N Rich, online queries for “how to delete Twitch” exploded 733% around the world on 6 October.

“With such a concerning data breach from a platform as widespread and global as Twitch, users are naturally wanting to protect themselves and their data as soon as possible,” a spokesperson for N Rich commented on the findings. “Users will be expecting stringent action and protective measures in the future.”

Reuters contributed to this report

Comments are closed.