You are using an older browser version. Please use a supported version for the best MSN experience.

Twitch confirms major data breach after its source code and secrets leak out

The Verge logo The Verge 10/6/2021 Tom Warren
© Illustration by Alex Castro / The Verge

Twitch has confirmed that it has suffered a major data breach. “We can confirm a breach has taken place,” says a Twitch spokesperson on Twitter. “Our teams are working with urgency to understand the extent of this. We will update the community as soon as additional information is available.”

Hackers have so far leaked data that includes source code for the company’s streaming service, an unreleased Steam competitor from Amazon Game Studios, and details of creator payouts. An anonymous poster on the 4chan messaging board released a 125GB torrent earlier today, which they claim includes the entirety of Twitch and its commit history.

The leak has been labeled as “part one,” suggesting that there could be more to come. While personal information like creator payments is included, this initial leak doesn’t appear to include passwords, addresses, or email accounts of Twitch users. Instead, the leaker appears to have focused on sharing Twitch’s own company tools and information, rather than code that would include personal accounts.

It’s not clear how much data has been accessed, though. Twitch says it’s working to understand its security breach, and it appears that some users are being asked to change their passwords. Until we understand the extent of this breach, we’d recommend changing your Twitch password and enabling two-factor authentication if you haven’t already done so.

The Twitch leak will be damaging for the game streaming service either way and particularly for creators who rely on Twitch to keep their earnings and information secure. The hack follows weeks of protest for Twitch to improve its service under the #DoBetterTwitch movement. Twitch streamers also took a day off in August to protest against the company’s lack of action against hate raids.

Update, 11:32AM ET: Article updated with information on password resets.


More from The Verge

image beaconimage beaconimage beacon