Creator Drama
Twitch Data Breach: Source Code and Payouts Leaked
Resolved
Photo: Sora Shimazaki, Pexels All clips and posts below are embedded from their original sources.
By the numbers: this timeline documents 13 events from Sep 1, 2021 to Oct 15, 2021, drawn from 6 sources.
“The earnings list got my figure 100% correct.”
via bbc.com
Background
In October 2021, the live-streaming platform Twitch experienced a catastrophic security failure resulting in the public leak of a 125GB torrent file. The breach was not the result of a sophisticated external hack but was instead caused by a server configuration change that inadvertently exposed internal data to an unauthorized third party.
The attacker, remaining anonymous, posted the data to the 4chan messaging board, labeling the release as 'part one' and using the hashtag #DoBetterTwitch. The motivation appeared to be 'hacktivism,' with the poster describing the Twitch community as a 'disgusting toxic cesspool' and stating the leak was intended to foster more disruption and competition within the video streaming industry.
The leaked trove contained highly sensitive proprietary information, including the source code for the Twitch client, internal security tools, and proprietary SDKs. The data also encompassed internal AWS services and information from other Twitch-owned properties, such as CurseForge and IGDB.
Metadata from the leak revealed folders dedicated to 'infosec' (information security), 'devtools' (developer tools), and 'core config packages.' Beyond the technical code, the leak included encrypted passwords and financial records detailing the payouts made to streamers from August or September 2019 through October 2021.
The financial aspect of the leak caused significant disruption, as Twitch historically guarded the specific earnings of its creators. The documents suggested that top streamers were earning millions of dollars from the Amazon-owned company. This transparency occurred during a period of intense competition, as rivals like YouTube Gaming were actively offering large salaries to attract gaming talent.
While the leaked figures represented gross payouts from Twitch, they did not account for taxes, business expenses for large-scale media operations, or external sponsorship deals.
Additionally, the leak provided a glimpse into Amazon's secret development projects. Reports from users analyzing the data identified a project codenamed 'Vapor,' which was allegedly a competitor to Steam. This project reportedly integrated various Twitch features and provided specific support for games like PUBG and Fortnite.
The leak also allegedly contained Unity code and assets for a project called 'Vapeworld,' described as a potential VR chat application, including 3D emotes with specular and albedo maps.
The timeline
-
Creators initiate 'A Day Off Twitch' boycott
In early September, a group of creators reportedly organized a strike titled 'a day off Twitch.' This boycott was allegedly a protest against the platform's perceived lack of action regarding the issue of hate raids.[3]
Screenshot of bbc.com, captured Oct 4, 2026. Source [3] -
Unauthorized access to internal network
An anonymous attacker reportedly gained access to Twitch's internal network. This access was allegedly made possible by a server configuration error that created a vulnerability, allowing the party to exfiltrate 125GB of proprietary data.[2]
-
Twitch Issues Advisory Blaming Server Configuration Change
According to Ars Technica, Twitch issued an advisory at 10:30 pm PT blaming a server configuration change that was accessed by a malicious third party for the data exposure.[4]
Screenshot of arstechnica.com, captured Sep 13, 2026. Source [4] -
Massive data torrent leaked on 4chan
The attacker reportedly released a 125GB torrent file on 4chan. The leak allegedly included Twitch's source code, internal server details accessible only to employees, and creator payout data. Twitch acknowledged the breach on social media and stated they were working with urgency to investigate the extent of the incident.[2]
-
Streamers confirm accuracy of leaked earnings
Following the leak, Fortnite streamer BBG Calc stated that the earnings list was reportedly 100% correct regarding their figures. Other streamers and individuals linked to high-profile players also reportedly confirmed that the leaked payment details were 'accurate' or 'about right.'[3]
-
Discovery of 'Vapor' and 'Vapeworld' projects
Analysis of the leaked source code reportedly revealed 'Vapor,' an unreleased Amazon competitor to Steam that integrated Twitch features. The leak also allegedly contained Unity code and 3D assets for a VR-related project called 'Vapeworld.'[1]
-
Twitch Confirms Data Breach
The Verge reports that Twitch has reportedly confirmed a data breach and is working with urgency to understand its extent.[5]
Screenshot of theverge.com, captured Oct 4, 2026. Source [5] -
Video Games Chronicle Reports Leak
The Verge notes that Video Games Chronicle reportedly first reported details on the leak earlier that day.[5]
-
Twitch Confirms No Login Credentials Leaked
Ars Technica states that Twitch reportedly has no evidence login credentials were exposed in the breach.[4]
-
Twitch Confirms No Passwords Revealed
Engadget reports that the leak reportedly does not appear to include user passwords, addresses, or banking information.[6]
-
Twitch Confirms No Credit Card Numbers Leaked
Ars Technica notes that Twitch reportedly does not store full credit card numbers and confirms they were not exposed.[4]
-
Twitch mandates stream key resets
As a precautionary security measure following the breach, Twitch reportedly forced a reset of stream keys for all users on the platform.[2]
-
Twitch provides final breach update
Twitch issued an update confirming that the breach was reportedly caused by a server configuration error. The company explicitly stated that no full credit card numbers or login credentials appeared to be exposed during the incident.[2]
Our read of the evidence
Partly documented. The breach and Twitch's statements are described in reports from several outlets, but no primary source confirmation is provided in the evidence. Twitch's comments appear in those reports, indicating on‑record communication, while independent verification of the leaked data remains pending.
Our rating counts evidence, not opinions about anyone: events confirmed by a primary source (the person's own post, their official site, a court or government record) weigh most, then how many independent outlets report the story.
Frequently asked
What caused the Twitch data breach?
The breach was caused by a server configuration change that inadvertently exposed internal data, allowing an unauthorized third party to access the network.
What specific information was leaked?
The 125GB leak included Twitch's source code, creator payout information, proprietary SDKs, internal AWS services, and data from IGDB and CurseForge.
Were user passwords and credit cards stolen?
Twitch officially confirmed that no login credentials or full credit card numbers were exposed, although some reports mentioned the presence of encrypted passwords in the leak.
What was 'Vapor' in the Twitch leak?
Vapor was allegedly the codename for an unreleased Amazon competitor to Steam that aimed to integrate Twitch features and game-specific support for titles like Fortnite and PUBG.
More related drama (4)
Sources (6)
- twitter.com, Sinoc (@Sinoc229) on X, Oct 6, 2021.
- huntress.com, Twitch Data Breach: What Happened, Impact, and Lessons.
- bbc.com, Twitch confirms massive data breach.
- arstechnica.com, Twitch source code, creator earnings exposed in 125GB leak, Oct 6, 2021.
- theverge.com, Twitch hack: source code and creator payouts part of massive leak, Oct 6, 2021.
- engadget.com, Twitch's source code and streamer payment figures have been leaked following hack, Oct 6, 2021.
Cite this timeline
This timeline compiles 13 dated events from 6 sources. If it helped your reporting, cite it:
GenZHype. “Twitch Data Breach: Source Code and Payouts Leaked.”
GenZHype, 23 August 2026,
https://genzhype.com/drama/twitch-data-breach-source-code-and-payouts-leaked-2026/.