Twitch in crisis as it blames server error for massive data breach
All down to a configuration change, apparently.
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
The Twitch hackis real, it’s massive, and security experts are aghast at the scale of the thing: “this is as bad as it could possibly be.” The leak, which the hackers claim is only “part one,” contains the site’s source code,unannounced projects such as a Steam competitor, andthe earnings of streamers.
Yesterday Twitch issued what was very mucha holding statement, and has now expanded upon what it believes happened. Per theTwitch blog:
“We have learned that some data was exposed to the internet due to an error in a Twitch server configuration change that was subsequently accessed by a malicious third party. Our teams are working with urgency to investigate the incident.
“As the investigation is ongoing, we are still in the process of understanding the impact in detail. We understand that this situation raises concerns, and we want to address some of those here while our investigation continues.”
That is, Twitch is putting this down to the human element: someone set up the company’s servers incorrectly, and the hackers were able to find and access it. Whether this is human error or something more nefarious is unknown for now.
And the other thing this statement makes clear is that Twitch itself is still trying to understand just how bad this is.
Twitch notably doesn’t say when this breach happened, though the data included in the leak goes back up to three years. Twitch’s statement goes on to clarify that it believes personal data such as logins is not at risk, and emphasised that “full credit card numbers are not stored by Twitch, so full credit card numbers were not exposed.” Whether the former can be taken at face value remains to be seen.
The biggest gaming news, reviews and hardware deals
Keep up to date with the most important stories and the best deals, as picked by the PC Gamer team.
Finally, Twitch has reset all stream keys “out of an abundance of caution.” Streamers can get their new keyhere.
Twitch will be in full crisis mode behind-the-scenes because, even if it’s worked out what happened, that doesn’t do anything about the fact it has happened—and what that means now and in the future. The repercussions are potentially enormous and elements of that are far beyond the control of even an Amazon-backed company.
“A lot more damage is now in store for Twitch,” Candid Wuest from cyber-security company Acronistold the BBC. “The breach is already harming Twitch on all the fronts that count. [This leak] could contain nearly the full digital footprint of Twitch, making it one of the most severe data breaches of late. Releasing payout reports for streaming clients will not make the influencers happy either.”
We’ll keep you updated as this story develops. Meantime, dochange your password and set up two-factor authentication.
Rich is a games journalist with 15 years' experience, beginning his career on Edge magazine before working for a wide range of outlets, including Ars Technica, Eurogamer, GamesRadar+, Gamespot, the Guardian, IGN, the New Statesman, Polygon, and Vice. He was the editor of Kotaku UK, the UK arm of Kotaku, for three years before joining PC Gamer. He is the author of a Brief History of Video Games, a full history of the medium, which the Midwest Book Review described as “[a] must-read for serious minded game historians and curious video game connoisseurs alike.”
Steam Game Recording is now available for everyone, and it’s packed with neat features
Five new Steam games you probably missed (November 4, 2024)
Blizzard veteran David Kim’s strategy comeback with Battle Aces is ‘very personal:’ ‘I just can’t accept… the end-all peak of RTS is StarCraft 2 and nothing can ever be better’
