The Margin

Reported Twitch hacker leaks entire source code and streamers’ incomes for the past three years

Users should change their passwords and turn on two-factor authentication

The Twitch streaming service has reportedly been hit by a massive hack.

Lionel Bonaventure/Agence France-Presse/Getty Images

Referenced Symbols

An anonymous hacker has posted all of Twitch’s source code and its streamers’ incomes since 2019, according to reports from multiple news outlets. 

VGC, a video games news site, first reported the apparent Twitch leak on Wednesday. A 125-gigabyte torrent link was posted to the 4chan message board, it reported. The leaker wrote that the data breach was intended to “foster more disruption and competition in the online video streaming space,” calling the Twitch community “a disgusting toxic cesspool.”

Neither Twitch nor its parent company Amazon AMZN, +0.37% were immediately available for comment. The Verge reported that it could confirm the leak is legitimate, although it did not name its source. VGC cited anonymous sources within the company. 

The news led #TwitchLeak to trend on Twitter on Wednesday morning, and Google searches on how Twitch users could protect their personal information also jumped.

The leaked information reportedly includes: 

  • Twitch.tv’s entire source code, including comment history “going back to its early beginnings.” 
  • The source code for mobile, desktop and console Twitch clients.
  • Details about creator payouts for the past three years. 
  • Code related to proprietary software development kits (SDKs) and internal Amazon Web Services (AWS) services used by Twitch.
  • ”Every other property that Twitch owns,” including the video game database IGDB and gaming website CurseForge.
  • An unreleased Steam competitor for Amazon Game Studios. 
  • Twitch’s internal security tools. 

What’s more, the leak has been labeled as “part one,” implying there could be more hacked data to come. While the initial leak doesn’t appear to include Twitch user passwords or home addresses, some Twitter users that have been poring over the 125 gigabytes of data claim that the torrent does include encrypted passwords.

Twitch users should probably change their passwords and turn on two-factor authentication if they haven’t activated it already. Here’s how: 

  • Log into Twitch, click on your avatar and choose “Settings.” 
  • Select “Security and Privacy” and scroll down to “Security.” 
  • Click “Edit Two-Factor Authentication” and follow the instructions to turn it on.

The leaked data does apparently reveal just how much money popular Twitch streamers are earning directly from Twitch. Some 81 have been paid more than $1 million by Twitch since August 2019, likely from subscriptions and advertising revenue, according to the leaked documents. 

Topping the list is Critical Role, which streams Dungeons & Dragons sessions, which has scored more than $9.6 million from Twitch payouts in the past two years, according to the leaked documents. And Overwatch player xQcOW, Counter-Strike players summit1g and Fortnite player Tfue made more than $5 million apiece.