In the last few hours Twitch would have suffered a attack by some hacker, which they would have stolen well 130GB of sensitive data and then publish them online on 4chan. If the news were to be confirmed, it would be the most big leak never right away from the company, home of streaming for video game enthusiasts and more.
Twitch hacker attack, 130GB of sensitive data stolen
In the last few hours, someone has posted a huge torrent file on 4chan, with 130GB of data stolen from Twitch. According to the earliest reconstructions, the hackers would have carried out an attack earlier this week against the streaming service most used by gamers all over the world and beyond. Inside the file there are therefore a lot of sensitive data taken from the platform.
The leak appears to have enormous proportions. In the 130GB of files there are essential data such as the source code of the platform, which could thus be exposed to further cyber attacks. But there are also the compensation paid to streamers from 2019 through today, as well as customer data divided by PC, mobile and console.
Inside the files there would even be news not yet presented, such as the code for a digital marketplace inside the platform called Project Vapor, a possible Steam competitor operated by Amazon. The conditional remains a must, given that there is no confirmation from the company (especially on these projects still under corporate secrecy).
But several newspapers (including VideoGameChronicles, who first reported the news) would have confirmed the authenticity of the material: the file torrent it really contains the information promised by the hackers. Even if without Twitch confirmation, we cannot know if it is true and stolen information from the platform.
An epochal leak
Inside the file posted online, there are tons of different sensitive documents. VGC confirmed that there would be data relating to:
- Twitch source code, with all comments shared on the platform since the birth of the service
- I fees to streamers from 2019 to today
- I client app divided by mobile, desktop and console
- SDK proprietari and AWS (Amazon Web Services) internal services used by Twitch
- Information on other Twitch companies, such as IGDB and CurseForge
- Information on Project Vapor, which looks like a Steam competitor created by Amazon Game Studios
- Internal “red teaming” tools for security
Twitch hack: what to do to protect your account?
At the moment it is unclear whether data theft also includes passwords and login credentials both personal and business. In fact, some sources seem to indicate that the information in the torrent package is only a part of the stolen data.
However, for now to comment on account security is premature: we must wait for a comment from the company to understand if users really need to take security measures. We were able to log into our account without a problem, so access doesn’t seem compromised. As a precaution you could change the password and enable authentication a two factors. We repeat that at the moment, however, it is not confirmed that among the stolen data there is information on access credentials.
The situation will evolve in the next few hours, with Twitch wanting to shed some light on what happened as soon as they have established the facts. We will keep you posted.