Twitch: No credentials or card numbers exposed in data breach

Twitch says that no login credentials and credit card numbers belonging to users or streamers were exposed following yesterday's massive data leak.

The company added that the attackers could gain access to the stolen data due to a faulty Twitch server configuration change.

"We have learned that some data was exposed to the internet due to an error in a Twitch server configuration change that was subsequently accessed by a malicious third party," Twitch said.

"At this time, we have no indication that login credentials have been exposed. Additionally, full credit card numbers are not stored by Twitch, so full credit card numbers were not exposed."

Twitch security teams are still investigating the incident to fully assess the impact of this incident.

"Our teams are working with urgency to investigate the incident. As the investigation is ongoing, we are still in the process of understanding the impact in detail," the company added.

Our investigation is ongoing, and we are in the process of analyzing all of the relevant logs and data to assess actual impact. For an update see https://t.co/mp8wndXv03

— Twitch (@Twitch) October 7, 2021

In a follow-up update, Twitch said that it also reset all stream keys and asked streamers to go through the following procedure before starting their next stream:

• Twitch Studio, Streamlabs, Xbox, PlayStation and Twitch Mobile App users should not need to take any action for your new key to work. 
• OBS users who have connected their Twitch account should also not need to take any action. OBS users that have not connected their Twitch account to OBS will need to manually copy their stream key from their Twitch Dashboard and paste it into OBS. 
• For all others, please refer to specific setup instructions for your software of choice. 

125 GB of stolen source code and payment reports

While Twitch didn't reveal what servers were misconfigured to cause the breach, the leaker who posted the leak on the 4chan bulletin board said the data was allegedly stolen from roughly 6,000 internal Twitch Git repositories.

"Their community is also a disgusting toxic cesspool, so to foster more disruption and competition in the online video streaming space, we have completely pwned them, and in part one, are releasing the source code from almost 6,000 internal Git repositories," the anonymous poster said.

According to the 4chan user, the leaked archive contains the following Twitch info:

• The entirety of twitch.tv, with commit history going back to its early beginnings
• Mobile, desktop, and video game console Twitch clients
• Various proprietary SDKs and internal AWS services used by Twitch
• Every other property that Twitch owns, including IGDB and CurseForge
• An unreleased Steam competitor from Amazon Game Studios
• Twitch SOC internal red teaming tools (lol)
• Creator payout reports from 2019 until now.

They also named the 4chan thread "twitch leaks part one," which hints at additional stolen data likely to be leaked soon.

BleepingComputer confirmed that the stolen info looks authentic and matches what was disclosed by the 4chan user.