Creator Drama
The Twitch Data Leak: Source Code, Payouts, and Vapor
Resolved
Photo: Ann H, Pexels All clips and posts below are embedded from their original sources.
By the numbers: this timeline documents 7 events from Oct 4, 2021 to Oct 15, 2021, drawn from 4 sources.
“The earnings list got my figure 100% correct.”
via bbc.com
Background
In October 2021, the live-streaming platform Twitch experienced a catastrophic security incident when an anonymous actor published a colossal 125GB torrent file. The trove included proprietary source code, internal security tools, and sensitive financial data detailing creator earnings over a multi-year period.
Security experts and platform representatives confirmed that the breach was not the result of a complex hack, but rather a simple server configuration change that inadvertently exposed internal data. The leak sparked immense discussion across gaming and creator communities regarding cloud server security and platform transparency.
The timeline
-
Initial Server Access
An anonymous attacker gains unauthorized access to Twitch's internal network due to a server configuration error, according to retrospective platform disclosures.[2]
-
Twitch Attributes Breach to Configuration Change
Twitch posted an advisory blaming the data exposure on a server configuration change that was accessed by a malicious third party, according to Ars Technica.[4]
Screenshot of arstechnica.com, captured Sep 13, 2026. Source [4] -
Massive 125GB Torrent Leaked on 4chan
An anonymous user reportedly leaks a 125GB torrent file on the 4chan messaging board, allegedly containing Twitch source code, creator payouts, and references to unreleased projects like an Amazon Steam competitor codenamed Vapor.[1]
-
Twitch Acknowledges Security Incident
Twitch formally confirms the security breach via social media statements, noting that the company is reportedly working with urgency to understand the full scope of the exposed data.[2]
-
Streamers Verify Payout Accuracy
Several prominent content creators and industry figures reportedly confirm to news outlets that the leaked creator revenue figures spanning from 2019 to 2021 are accurate.[3]
Screenshot of bbc.com, captured Oct 4, 2026. Source [3] -
Stream Keys Reset for All Users
As a direct precautionary security measure following the reported source code and internal data exposure, Twitch reportedly forces a global stream key reset for all platform users.[2]
-
Twitch Details Configuration Error
Twitch provides an official update confirming that login credentials and full credit card numbers were reportedly not exposed, clarifying that the incident was allegedly caused by a server configuration error.[2]
Our read of the evidence
Partly documented. All seven timeline events are derived from secondary reports; none are confirmed by a primary source such as an official Twitch statement or forensic audit. The information comes from four distinct outlets, indicating multiple corroborating reports but lacking direct verification. Consequently, the evidence is considered partly documented.
Our rating counts evidence, not opinions about anyone: events confirmed by a primary source (the person's own post, their official site, a court or government record) weigh most, then how many independent outlets report the story.
Frequently asked
What was the cause of the Twitch data leak?
As of October 6, 2021, per arstechnica.com, Twitch attributed the breach to a server configuration change accessed by a malicious third party.
What data was exposed in the Twitch leak?
The 125GB leaked file contained Twitch's entire website source code, client versions, creator payout reports, internal AWS services, and details regarding unreleased projects such as an Amazon Steam competitor codenamed Vapor.
Was the Twitch breach caused by a hack?
Twitch confirmed the breach was not caused by a sophisticated cyberattack, but rather by a human error involving a server configuration change that inadvertently exposed internal data to an unauthorized third party.
Were user passwords or credit card numbers leaked?
Twitch confirmed in its follow-up investigations that login credentials and full credit card numbers were not exposed during the security incident.
More related drama (4)
Sources (4)
Cite this timeline
This timeline compiles 7 dated events from 4 sources. If it helped your reporting, cite it:
GenZHype. “The Twitch Data Leak: Source Code, Payouts, and Vapor.”
GenZHype, 22 August 2026,
https://genzhype.com/drama/the-twitch-data-leak-source-code-payouts-and-vapor/.