In a statement on its official blog, Twitch said: "We have learned that some data has been exposed to the Internet due to an error in changing the configuration of the Twitch server that was subsequently accessed by a malicious third party. Our teams are urgently working to investigate the incident. As the investigation continues, the investigation continues. We are still in the process of understanding the impact in detail. We understand that this situation raises concerns, and we want to address some of those concerns here while our investigation continues. At this time, we have no indication that login credentials have been revealed. We are continuing to investigate. Additionally Full credit card numbers are not stored by Twitch, so full credit card numbers are not disclosed."
According to The Verge, citing the Video Games Chronicle, the site confirms the legitimacy of this leak, and the latter includes: details equal to 3 years regarding payments to creators on Twitch, the entirety of twitch.tv, “with commitment history back to its beginnings” source code for Twitch customers on Mobile, desktop, and video games Code related to software development kits (SDKs) and internal AWS services used by Twitch, a Steam competitor not released by Amazon Game Studios, data on other Twitch properties such as IGDB and CurseForge, and thus Twitch's internal security tools.
The Verge notes that the leak does not appear to include the password or address information of Twitch users, but that does not mean that this information was not obtained as part of the breach. In fact, the leaker appears to have focused on sharing the company's tools and information to Twitch, rather than code that might include personal accounts. There is more to come.
