Creator Drama
Twitch Data Breach: Source Code, Payouts, and Internal Data Leaked
Resolved
Photo: Sora Shimazaki, Pexels All clips and posts below are embedded from their original sources.
By the numbers: this timeline documents 9 events from Sep 1, 2021 to Oct 22, 2021, drawn from 3 sources.
“suggesting more data could be released. The post included the hashtag”
via huntress.com
Background
Twitch, a prominent live-streaming platform owned by Amazon, experienced a significant data breach in October 2021. The incident involved the public release of a substantial amount of confidential company information and user data. Prior to the breach, the Twitch community had seen some internal tensions, including a boycott titled "a day off Twitch" in early September, where creators protested the platform's perceived lack of action against "hate raids."
The platform is known for fiercely guarding operational details, such as streamer payouts, making the subsequent leak particularly embarrassing for the company. This incident occurred at a time when competitors such as YouTube Gaming were reportedly offering large salaries to attract streaming talent, suggesting the fallout could be significant for Twitch.
The breach highlighted the critical risks associated with misconfigured cloud servers and prompted a re-evaluation of security practices across the industry.
The timeline
-
Creators Boycott Twitch Over 'Hate Raids'
In early September, a boycott titled "a day off Twitch" reportedly saw creators effectively strike in protest at the platform's alleged lack of action on "hate raids." This event preceded the data breach, indicating existing tensions within the Twitch community. (Source 5)[2091]
-
Attacker Gains Access to Twitch's Internal Network
An unauthorized actor reportedly gained access to Twitch's internal network. This access was attributed by Twitch to a server configuration change that inadvertently exposed internal data. This misconfiguration created an opening for the threat actor to access the company’s systems, bypassing even robust security tools. While Twitch did not disclose the specific nature of the misconfiguration, it was severe enough to allow the exfiltration of a large volume of data. (Source 4)[2090]
-
Massive 125GB Data Leak Publicly Disclosed on 4chan
An anonymous actor publicly leaked a colossal 125GB torrent file containing sensitive company data on the 4chan messaging board. The leak was labeled "part one" by the attacker, suggesting the potential for further data releases. The post included the hashtag "#DoBetterTwitch," indicating that the leak may have been an act of "hacktivism" intended to harm Twitch's reputation and business. The leaked data reportedly included the entire website's source code with comments for the website and various console/phone versions, references to an unreleased Steam competitor codenamed "Vapor," payouts, and encrypted passwords. It also contained proprietary SDKs, internal AWS services, and data from other Twitch-owned properties like IGDB and CurseForge. Metadata posted to internet forums reportedly showed folders named after important software areas, including "core config packages," "devtools" (developer tools), and "infosec" (information security). (Source 1, 2, 3, 4, 5)[2087]
-
Twitch Confirms Security Incident and Initiates Investigation
On the same day the data was reportedly publicly leaked, Twitch reportedly acknowledged the security incident. The company reportedly posted a statement on Twitter, confirming the breach and stating that it was "working with urgency" to understand the extent of the compromise. Twitch also reportedly committed to updating the community as soon as additional information became available, indicating the start of an internal investigation. (Source 4, 5)[2090]
-
Streamer Payouts Reportedly Verified by Individuals
Following the leak, documents appearing to show Twitch's top streamers' earnings from August or September 2019 to October 2021 were shared in online forums. Several streamers reportedly confirmed the accuracy of the leaked figures. Fortnite streamer BBG Calc told BBC News that his figure was "100% correct." Another streamer reportedly confirmed their earnings were "accurate," while a third person closely linked to a high-profile player stated the details were "about right." The documents reportedly pointed to well-known streamers, including the Dungeons & Dragons channel CriticalRole, Canadian xQC, and American Summit1g, as being among the top earners. It was noted that these payment lists likely did not include sponsorship deals or other off-platform activities, nor did they account for taxes or business expenses for streamers operating as large-scale media operations. (Source 5)[2091]
-
Anonymous Leaker's Motivation Allegedly Revealed
In the earliest known online post linking to the leaked data, the anonymous poster reportedly labeled the Twitch community "a disgusting toxic cesspool." The leaker claimed the data was being posted "to foster more disruption and competition" in video streaming, suggesting a motivation beyond mere financial gain or simple data theft and aligning with a 'hacktivism' intent. (Source 5)[2091]
-
Twitch Forces Stream Key Reset for All Users
As a precautionary measure following the reported breach, Twitch reportedly implemented a mandatory stream key reset for all users. This action was reportedly taken to mitigate potential risks associated with the leaked data, although Twitch later reportedly confirmed that login credentials were not exposed. The reset reportedly aimed to enhance security for streamers and their channels. (Source 4)[2090]
-
Twitch Provides Update: No Login Credentials or Credit Card Numbers Exposed
Twitch issued an update regarding the breach, stating that no login credentials or full credit card numbers were exposed in the incident. The company reiterated that the cause of the breach was reportedly a server configuration error, which allowed an unauthorized third party to access its systems. This update appeared to aim to reassure users about the safety of their personal financial and login information, while still acknowledging the severity of the data exfiltration. (Source 4)[2090]
-
UK Information Commissioner's Office Not Notified
As of the reporting date, the UK's Information Commissioner's Office (ICO) stated that it had not been notified of any data breach by either Twitch or its parent company, Amazon. This appears to indicate that official regulatory reporting in certain jurisdictions was either pending or not deemed necessary by Twitch based on the nature of the exposed data. (Source 5)[2091]
Frequently asked
What data was exposed in the Twitch breach?
The leaked data reportedly included the entire source code for twitch.tv and various console/phone versions, creator payout information, encrypted passwords, references to an unreleased Steam competitor codenamed "Vapor," proprietary SDKs, internal AWS services, and data from Twitch-owned properties like IGDB and CurseForge. (Source 1, 4, 5)
When did the Twitch data breach occur?
An attacker gained access to Twitch's internal network on October 4, 2021. The 125GB torrent file containing the leaked data was publicly posted on October 6, 2021, the same day Twitch confirmed the security incident. (Source 4)
How did the Twitch data breach happen?
Twitch confirmed that the breach resulted from a server configuration change that inadvertently exposed internal data, allowing an unauthorized third party to access the company’s systems. (Source 4)
Were user login credentials or credit card numbers exposed?
Twitch provided an update on October 15, 2021, confirming that no login credentials or full credit card numbers were exposed in the breach. (Source 4)
What was the alleged motivation behind the Twitch data leak?
The anonymous poster who leaked the data reportedly labeled the Twitch community "a disgusting toxic cesspool" and claimed the leak was intended "to foster more disruption and competition" in video streaming. (Source 5)
Related drama
Sources
- twitter.com, Sinoc on X: "https://t.co/7vTDeRA9vt got leaked. Like, the entire website; Source code with comments for the website and various console/phone versions, refrences to an unreleased steam competitor, pa, Aug 22, 2026.
- huntress.com, In October 2021, the live-streaming giant Twitch was hit by a massive data breach that sent shockwaves through the gaming and creator communities. An anonymous actor leaked a colossal 125GB torrent fi, Aug 22, 2026.
- bbc.com, 6 October 2021Joe Tidy & David MolloyBBC NewsGetty ImagesGame-streaming platform Twitch has been the victim of a leak, reportedly divulging confidential company information and streamers' earnings.Mor, Aug 22, 2026.
Cite this timeline
This timeline compiles 9 dated events from 3 sources. If it helped your reporting, cite it:
GenZHype. “Twitch Data Breach: Source Code, Payouts, and Internal Data Leaked.”
GenZHype, 4 September 2026,
https://genzhype.com/drama/twitch-data-breach-source-code-payouts-and-internal-data-leaked/.