Twitch Warns Over Source Code Breach

Amazon-owned gaming community service Twitch has said that a massive data breach earlier this month mainly affected the company’s source code, with a “minimal” effect on end-users.

The firm first acknowledged the breach two weeks ago, soon after after a huge cache of data was published online.

Industry watchers have said the source code leak could create a security risk, as it allows anyone to search for vulnerabilities.

Twitch said its investigation has confirmed that the incident resulted from a server configuration change that allowed access by an unauthorised third party.

Internal data

“Our team took action to fix the configuration issue and secure our systems,” the company said in a statement.

It said user passwords “have not been exposed” and that it was “confident” that systems storing encrypted login credentials “were not accessed”.

It has previously said that it doesn’t store customers’ full credit card numbers.

“The exposed data primarily contained documents from Twitch’s source code repository, as well as a subset of creator payout data,” Twitch said.

It said it has undertaken a “thorough review” of the information published online and is “confident that it only affected a small fraction of users and the customer impact is minimal”.

Payout figures

The company said it’s directly contacting those affected and has taken further steps to secure the service.

The 135 GB trove of data,  initially published on message board 4chan by an anonymous user, included internal security tools, the code for an unreleased Amazon Game Studios gaming platform and a list of the highest-paid Twitch channels and how much they were paid, amongst other information.

The information reportedly showed that the highest-paid channel earned more than $10 million (£7.3m) in two years.

The person leaking the data said at the time that they intended to publish more.

Twitch earlier this month reset all users’ stream keys out of an “abundance of caution”.

The company acknowledged that users’ passwords were breached in a 2015 attack.

Amazon bought Twitch in 2014 for about $1bn.