Massive Twitch 4chan leak includes list of the top 10,000 streamer payouts

UPDATED (10/6/2021 @ 2:00 a.m. PT): Twitch has since confirmed on Twitter that a breach did indeed of data did indeed take place and has taken steps to attempt to sort out the matter, promising to share updates on the situation as soon as possible.

Furthermore, recently, an anonymous source at Twitch shared with Shacknews that based on the nature, degree, and specifics of the leak, it's highly likely that the leak was internal.

It’s a rough morning for Twitch and Twitch users going into today. Apparently, overnight, hackers got into a lot of behind-the-curtain data on the Twitch platform and have posted it on 4chan. Quite a lot was claimed to have been taken in the leak. The hackers claiming responsibility claimed to have gotten at Twitch’s source code, data on its mobile, TV, and gaming clients, data of its owned subsidiaries, and even the payouts for its top streamers, which were openly shared.

This leak was reported and confirmed by various sources on October 6, 2021, including Video Games Chronicle. Reportedly, a torrent file of about 125GB of data was dropped on 4chan, which could be downloaded as of this morning to access a deluge of content relating to Twitch. Among that information was the 2019 payout reports for top streamers like Shroud and CohhCarnage. VGC was told by anonymous sources that the leaked data was indeed legitimate and Twitch has been internally aware of the leak. The data is alleged to have been taken as recently as Monday, October 4, 2021.

According to posts on 4chan, the hack included breach and exposure of the following info:

The entirety of Twitch’s source code with comment history “going back to its early beginnings”
Creator payout reports from 2019
Mobile, desktop and console Twitch clients
Proprietary SDKs and internal AWS services used by Twitch
“Every other property that Twitch owns” including IGDB and CurseForge
An unreleased Steam competitor, codenamed Vapor, from Amazon Game Studios
Twitch internal ‘red teaming’ tools (designed to improve security by having staff pretend to be hackers)

PSA: Not listed is the fact that apparently passwords may have also been part of the breach, as discovered by various Twitter users combing the data. As such, it is suggested that Amazon and Twitch users may want to change their passwords and enable 2-factor authentication as an extra means of security. There are guides on how to do so on Amazon and Twitch readily available.

Twitch has been making moves to try to stop hate raid bots recently, but there is still plenty of work to be done. The hackers claim their goal was to “foster more disruption and competition in the online video streaming space” because Twitch’s “community is a disgusting toxic cesspool.” It is unclear if these actions were in retaliation for the hate raid bots or in support of them. Nonetheless, a password change may be in order as Twitch and Amazon sort out their situation.