Creator Drama
Twitch Data Breach: Source Code and Payouts Leaked
Resolved
Photo: Sora Shimazaki, Pexels All clips and posts below are embedded from their original sources.
By the numbers: this timeline documents 7 events from Sep 1, 2021 to Oct 15, 2021, drawn from 3 sources.
“suggesting more data could be released. The post included the hashtag”
via huntress.com
Background
In October 2021, the live-streaming platform Twitch experienced a catastrophic security failure resulting in the public leak of a 125GB torrent file. The breach was not the result of a sophisticated external hack but was instead caused by a server configuration change that inadvertently exposed internal data to an unauthorized third party.
The attacker, remaining anonymous, posted the data to the 4chan messaging board, labeling the release as 'part one' and using the hashtag #DoBetterTwitch. The motivation appeared to be 'hacktivism,' with the poster describing the Twitch community as a 'disgusting toxic cesspool' and stating the leak was intended to foster more disruption and competition within the video streaming industry.
The leaked trove contained highly sensitive proprietary information, including the source code for the Twitch client, internal security tools, and proprietary SDKs. The data also encompassed internal AWS services and information from other Twitch-owned properties, such as CurseForge and IGDB.
Metadata from the leak revealed folders dedicated to 'infosec' (information security), 'devtools' (developer tools), and 'core config packages.' Beyond the technical code, the leak included encrypted passwords and financial records detailing the payouts made to streamers from August or September 2019 through October 2021.
The financial aspect of the leak caused significant disruption, as Twitch historically guarded the specific earnings of its creators. The documents suggested that top streamers were earning millions of dollars from the Amazon-owned company. This transparency occurred during a period of intense competition, as rivals like YouTube Gaming were actively offering large salaries to attract gaming talent.
While the leaked figures represented gross payouts from Twitch, they did not account for taxes, business expenses for large-scale media operations, or external sponsorship deals.
Additionally, the leak provided a glimpse into Amazon's secret development projects. Reports from users analyzing the data identified a project codenamed 'Vapor,' which was allegedly a competitor to Steam. This project reportedly integrated various Twitch features and provided specific support for games like PUBG and Fortnite.
The leak also allegedly contained Unity code and assets for a project called 'Vapeworld,' described as a potential VR chat application, including 3D emotes with specular and albedo maps.
The timeline
-
Creators initiate 'A Day Off Twitch' boycott
In early September, a group of creators reportedly organized a strike titled 'a day off Twitch.' This boycott was allegedly a protest against the platform's perceived lack of action regarding the issue of hate raids.[2183]
-
Unauthorized access to internal network
An anonymous attacker reportedly gained access to Twitch's internal network. This access was allegedly made possible by a server configuration error that created a vulnerability, allowing the party to exfiltrate 125GB of proprietary data.[2182]
-
Massive data torrent leaked on 4chan
The attacker reportedly released a 125GB torrent file on 4chan. The leak allegedly included Twitch's source code, internal server details accessible only to employees, and creator payout data. Twitch acknowledged the breach on social media and stated they were working with urgency to investigate the extent of the incident.[2182]
-
Streamers confirm accuracy of leaked earnings
Following the leak, Fortnite streamer BBG Calc stated that the earnings list was reportedly 100% correct regarding their figures. Other streamers and individuals linked to high-profile players also reportedly confirmed that the leaked payment details were 'accurate' or 'about right.'[2183]
-
Discovery of 'Vapor' and 'Vapeworld' projects
Analysis of the leaked source code reportedly revealed 'Vapor,' an unreleased Amazon competitor to Steam that integrated Twitch features. The leak also allegedly contained Unity code and 3D assets for a VR-related project called 'Vapeworld.'[2179]
-
Twitch mandates stream key resets
As a precautionary security measure following the breach, Twitch reportedly forced a reset of stream keys for all users on the platform.[2182]
-
Twitch provides final breach update
Twitch issued an update confirming that the breach was reportedly caused by a server configuration error. The company explicitly stated that no full credit card numbers or login credentials appeared to be exposed during the incident.[2182]
Frequently asked
What caused the Twitch data breach?
The breach was caused by a server configuration change that inadvertently exposed internal data, allowing an unauthorized third party to access the network.
What specific information was leaked?
The 125GB leak included Twitch's source code, creator payout information, proprietary SDKs, internal AWS services, and data from IGDB and CurseForge.
Were user passwords and credit cards stolen?
Twitch officially confirmed that no login credentials or full credit card numbers were exposed, although some reports mentioned the presence of encrypted passwords in the leak.
What was 'Vapor' in the Twitch leak?
Vapor was allegedly the codename for an unreleased Amazon competitor to Steam that aimed to integrate Twitch features and game-specific support for titles like Fortnite and PUBG.
Related drama
Sources
- twitter.com, Sinoc on X: "https://t.co/7vTDeRA9vt got leaked. Like, the entire website; Source code with comments for the website and various console/phone versions, refrences to an unreleased steam competitor, pa, Aug 22, 2026.
- huntress.com, In October 2021, the live-streaming giant Twitch was hit by a massive data breach that sent shockwaves through the gaming and creator communities. An anonymous actor leaked a colossal 125GB torrent fi, Aug 22, 2026.
- bbc.com, 6 October 2021Joe Tidy & David MolloyBBC NewsGetty ImagesGame-streaming platform Twitch has been the victim of a leak, reportedly divulging confidential company information and streamers' earnings.Mor, Aug 22, 2026.
Cite this timeline
This timeline compiles 7 dated events from 3 sources. If it helped your reporting, cite it:
GenZHype. “Twitch Data Breach: Source Code and Payouts Leaked.”
GenZHype, 4 September 2026,
https://genzhype.com/drama/twitch-data-breach-source-code-and-payouts-leaked-2026/.