Twitch in crisis as it blames server error for massive data breach

Twitch in crisis as it blames server error for massive data breach

All down to a configuration change, apparently.


Twitch in crisis as it blames server error for massive data breach - image1
(Image credit: NurPhoto via Getty.)

Tʜᴇ Twɪᴛch hack ɪs ʀᴇᴀʟ, ɪᴛ's mᴀssive, ᴀɴd securɪᴛy experts ᴀʀᴇ aghᴀst ᴀᴛ tʜᴇ sᴄᴀʟᴇ ᴏꜰ tʜᴇ thɪɴg: "tʜɪs ɪs ᴀs ʙᴀᴅ ᴀs ɪᴛ ᴄᴏᴜʟᴅ possibly ʙᴇ." Tʜᴇ leak, ᴡʜɪᴄʜ tʜᴇ hackers ᴄʟᴀɪᴍ ɪs ᴏɴly "pᴀʀᴛ ᴏɴe," ᴄᴏɴᴛᴀɪɴs tʜᴇ sɪᴛe's sᴏᴜʀce code, unᴀɴɴᴏunced projects sᴜᴄʜ ᴀs a Sᴛᴇᴀᴍ competɪᴛᴏʀ, ᴀɴd tʜᴇ ᴇᴀʀnɪɴgs ᴏꜰ streaᴍᴇrs.

Yesterday Twitch issued what was very much a holding statement, and has now expanded upon what it believes happened. Per the Twitch blog:

"We have learned that some data was exposed to the internet due to an error in a Twitch server configuration change that was subsequently accessed by a malicious third party. Our teams are working with urgency to investigate the incident.

"As the investigation is ongoing, we are still in the process of understanding the impact in detail. We understand that this situation raises concerns, and we want to address some of those here while our investigation continues."

That is, Twitch is putting this down to the human element: someone set up the company's servers incorrectly, and the hackers were able to find and access it. Whether this is human error or something more nefarious is unknown for now.

And the other thing this statement makes clear is that Twitch itself is still trying to understand just how bad this is.

Twitch in crisis as it blames server error for massive data breach - image2

(Image credit: Bloomberg (Getty images))

Twitch notably doesn't say when this breach happened, though the data included in the leak goes back up to three years. Twitch's statement goes on to clarify that it believes personal data such as logins is not at risk, and emphasised that "full credit card numbers are not stored by Twitch, so full credit card numbers were not exposed." Whether the former can be taken at face value remains to be seen.

Finally, Twitch has reset all stream keys "out of an abundance of caution." Streamers can get their new key here.

Twitch will be in full crisis mode behind-the-scenes because, even if it's worked out what happened, that doesn't do anything about the fact it has happened—and what that means now and in the future. The repercussions are potentially enormous and elements of that are far beyond the control of even an Amazon-backed company.

"A lot more damage is now in store for Twitch," Candid Wuest from cyber-security company Acronis told the BBC. "The breach is already harming Twitch on all the fronts that count. [This leak] could contain nearly the full digital footprint of Twitch, making it one of the most severe data breaches of late. Releasing payout reports for streaming clients will not make the influencers happy either."

We'll keep you updated as this story develops. Meantime, do change your password and set up two-factor authentication.

Author's other posts