A hacker has stolen data from Twitch, including its source code and user data, and leaked it on 4chan.
VGC reports the hacker shared a 125GB torrent link to 4chan today (October 6th), with the goal to “foster more disruption and competition in the online video streaming space” because “their community is a disgusting toxic cesspool.” Last month, some of the website’s streamers organized a 24-hour walkout over “hate raids” that moderators were failing to address.
A company source told VGC that the leaked data was legitimate; which includes Twitch’s source code, and reportedly the following:
- Comment history “going back to its early beginnings“
- Creator payout reports from 2019
- Mobile, desktop and console Twitch clients
- Proprietary SDKs and internal AWS services
- Data relating to “every other property that Twitch owns” including IGDB and CurseForge
- An unreleased Steam competitor, codenamed Vapor, from Amazon Game Studios
- Twitch internal “red teaming” tools. This has staff pretend to be hackers to improve security
UPDATE: Twitch have now confirmed the hack publicly. “We can confirm a breach has taken place,” Twitch tweeted. “Our teams are working with urgency to understand the extent of this. We will update the community as soon as additional information is available. Thank you for bearing with us.”
Original story continues:
Devil Engine developer “Sinoc” stated on Twitter that the data also included encrypted passwords. They also shared a screenshot, allegedly showing streamer revenue numbers; between September 2019 to September 2021.
In addition, Sinoc explains how Vapor seemingly utilized Twitch features, and support for specific games such as Fortnite and PlayerUnknown’s Battlegrounds. There was also mention of a Unity engine game called “Vapeworld.” Sinoc assumes it would be akin to VR Chat. It also featured 3D emote models, along with specular and albedo maps.
This is not the end however, as the leaker reportedly stated this is only the first part of the content they plan to leak. When the next batch will contain was not released.