Leak on Twitch, income from streamers: 4 questions about the colossal leak that would hit the platform

Twitch is said to be the victim of a major incident. Significant amounts of confidential information would have ended up online, but also source code, internal tools and lists showing the earnings of streamers.

This is possibly the worst information leak that Twitch could ever fall victim to. According to elements published on the web this Wednesday, October 6, the live broadcasting platform would be the victim of a colossal incident, which would have resulted in the dissemination of a lot of confidential information, in particular the gains harvested by videographers over the past three years. . According to an internal source, who delivered to the VideoGamesChronicle site, the information would have been retrieved on Monday, October 4, 2021.

The data of this leak would be offered in particular in a torrent file, which circulates among others on 4chan, the famous imageboard – a sort of specialized forum where everyone is anonymous – with a very sulphurous reputation. The archive in question weighs over 125 GB and is shared in specific sections of 4chan. At the same time, information was copied to Pastebin, namely the earnings of streamers.

Numerama was able to access the Pastebin documents, as well as some Twitter threads and discussions on 4chan, and are in the process of verifying the veracity of this huge leak. We have also contacted Twitch to confirm the reality of the incident and obtain details, if any, on the circumstances of the leak.

This leak could be followed by one or more others. Indeed, on one of the threads published on 4chan, the title of the title announces ” twitch leaks part one “. However, it is not clear when the next disclosure (s) will occur, or what they will contain. Twitch, for its part, has not yet officially responded.

The motivations behind this massive operation that just hit Twitch are uncertain, but the post on 4Chan describes Twitch and its community as ” a disgusting toxic cesspool “. The message does not say how, but the platform is often singled out for the problems of sexual harassment, of sexualization of videographers or even hatred.

Recently, videographers had gathered to a strike operation on Twitch to request the service to take much stronger action against hostile raids targeting streamers because of their ethnicity, sexual orientation or gender. Twitch recently activated new layouts to better secure chats.

The message posted on 4chan also justifies this attack in the name of healthier competition in the video game streaming industry, which is dominated almost exclusively by the Amazon subsidiary, despite YouTube Gaming’s attempt. By publishing this leak, it would be ” foster disruption and competition in online video streaming “. And for that, it took, continues the publication, ” burst completely »Twitch.

All Twitch Source Code

According to the user who uploaded the archive of 135 and a few gigas, today’s leak mainly concerns Twitch software repositories. This would therefore include the source code of the site, various mobile applications, moderation and development tools as well as all the history of the code. This would already constitute a considerable database since having access to all these tools makes it possible to detect flaws, to understand the functioning of algorithms, recommendation tools, etc.

Twitch streamer income

It appears that financial information has also been leaked. The revenues (over 3 years) of more than 10,000 Twitch streamers have been published online. However, it seems unlikely that Twitch will host this kind of data on its software repositories. The leak of accounting data seems to serve more to draw attention to this large-scale hack. The idea, according to one of the hackers behind the leak, also seems to put the streamers in an awkward position.

Passwords ?

Passwords and personal information for Twitch viewers, however, do not appear to have been leaked yet. That said, this 135 GB archive is labeled as the “first part” of this Twitch leak. It is therefore possible that a second file will arrive later. It is not excluded that the latter contains the connection data of Internet users using Twitch. The platform uses a priori encryption methods to keep passwords secret, even in the event of an intrusion. Other personal information such as email address or phone number may however be visible.

Vapor

The leak would also concern projects in development. Among them, we find traces of the project Vapor, a competitor to the Steam games store that Amazon is said to be developing.

AWS Access Codes

Finally, to make matters worse, some access codes to the AWS platform (which hosts Twitch) also seem to be available in the archive. Very bad news for Twitch and Amazon since access to production servers opens a lot of doors to retrieve even more data.

As it stands, it is mainly the videographers who make their living on Twitch who would be in difficulty. Indeed, their supposed gains appear in the leak and are already formatted in tables to facilitate research. A priori, the amounts involved are the amounts won between August 2019 and October 2021. Some tables even classify videographers according to the money received.

There are naturally many videographers from across the Atlantic in these columns, like Pokimane, Asmongold and HasanAbi, to name just three. But there are also French-speaking sizes: Zerator, kamet0, mistermv, Sardoche, Squeezie, Zoltan, Domingo, Ponce, Tonton, Lapi, etc. To put it another way, that’s all Twitch-game which is mentioned in these documents.

In all, a Pastebin document lists no less than 10,000 names of videographers. Another, which is also circulating, provides information, for example, of the earnings supposedly obtained in September 2021. It should be noted that the amounts involved are only those coming directly from Twitch. They do not include sums that may be collected alongside, such as donations, sponsorship, sale of derivative products and so on …

Regarding the public, it is not proven that personal information was released. At least, the first archive that runs doesn’t seem to contain any. There are also, obviously, no files that would provide information on combinations of identifiers and passwords to access individual accounts. But it might be wise to Change password and D’enable strong authentication.

Article under development.