Twitch says ‘server configuration change’ resulted in massive data leak

Twitch has released an update on a massive hack that appears to have exposed the source code, streamer payout numbers, and other information. He said the data was exposed on the internet “due to an error in a Twitch server configuration change which a malicious third party subsequently accessed.” He added that his teams were working “urgently” to investigate the attack.

The Amazon-owned streaming site added that it had “no indication” that login credentials, including passwords, were exposed. “Additionally, full credit card numbers are not stored by Twitch, so full credit card numbers have not been exposed,” the company said.

Twitch also said that “as a precaution we have reset all flow keys” and provided a link to get a new one. Depending on the streaming software you are using, you may need to manually update your software to start a new stream. “Twitch Studio, Streamlabs, Xbox, PlayStation, and Twitch Mobile App users shouldn’t need to take any action to get your new key to work,” he writes. “OBS users who have connected their Twitch account should also not need to take any action.”

However, if you haven’t connected your OBS account to Twitch, you’ll need to manually copy your feed from the Twitch dashboard and paste it into OBS. “For all others, please refer to the configuration instructions specific to the software of your choice.”

Yesterday, attackers said they stole “all of Twitch.tv”, including the site’s mobile, desktop and console Twitch clients. It also had access to proprietary SDKs and internal AWS services, red-teaming tools, and more. All of this information could make Twitch vulnerable to future attacks by letting potential hackers probe for weaknesses.

The leak also shows millions of creator payouts for streamers like xQc, Nickmercs and Shroud. Several have confirmed that the figures are correct.

Twitch said the investigation is ongoing. “We’re still figuring out the impact in detail,” the company wrote.

Updated 10/7/2021 4:54 AM ET: Twitch has reset all flow keys and advised users on how to update their software. This information was added to the article.