The 4chan user who allegedly posted Twitch data said they did so to hurt Twitch’s business. The person claimed to have access to information including Twitch source code, internal security tools and creator payouts.
Twitch confirmed the breach. "Our teams are working with urgency to understand the extent of this," the company wrote on Twitter.
"Their community is also a disgusting toxic cesspool, so to foster more disruption and competition in the online video streaming space, we have completely pwned them," the user who allegedly posted Twitch data wrote on 4chan, using a slang word for hack. "Find out how much your favorite streamer is really making!"
The user labeled the data dump as "part one," suggesting there might be more to come.
A Twitch spokeswoman declined to comment on what data was taken. The hack was earlier reported by videogameschronicle.com.
The alleged hacker alluded to Amazon’s ownership of Twitch, posting their message alongside a photo of Amazon founder Jeff Bezos.
"Jeff Bezos paid $970 million for this, we’re giving it away FOR FREE," the user wrote. "#DoBetterTwitch."
An Amazon representative wasn’t immediately available for comment.
Amazon bought Twitch, originally known as Justin.tv, in 2014 for about $970 million in cash. It currently boasts an average of more than 2.5 million viewers at any given time, and more than seven million creators stream live video on the platform each month, according to its own data.
Several Twitch streamers posted on social media that many of the leaked payout figures were consistent with what they earned on the platform. The data showed some users reaching payouts in the six figures.
Scott Hellyer, a streamer who has been part of Twitch’s partner program for six years, said in a direct message on Twitter that information about his payouts was exposed in the breach.
"I really hope that no major personal info (Full names, emails, address, phone number, banking info) gets out in the rumored next part of the leak," said Mr. Hellyer, who has about 72,000 followers on his channel, "tehMorag." "I’ll take the heat if people are surprised about how much I make in the coming days, and try to have an open dialog about it."
Hackers for years have targeted gamers to cheat and take over accounts, increasingly training their sights on developers to steal potentially valuable information about forthcoming releases. Earlier this year, Redwood City, Calif.-based Electronic Arts Inc. and Polish game developer CD Projekt SA each reported hacks. Rather than holding hostage CD Projekt’s data for ransom, hackers said at the time that they would auction source code for games on the dark web.
Cyberattacks on organizations world-wide are up 40% this year compared with the first 10 months of 2020, according to security firm Check Point Software Technologies Inc.
Mark Ostrowski, director of engineering for Check Point in the eastern U.S., said the potential breach of Twitch’s source code could open the door for future incidents.
"Silently you have hackers, competitors and users scouring the code to find flaws to exploit or gain a competitive advantage in their own development," he said.
It is unclear whether the breach included additional personal data about Twitch users. People who use the platform should change their passwords and enable multifactor authentication on their accounts as a precaution, said Jarno Niemelä, principal researcher at Finnish cybersecurity firm F-Secure.
The incident comes after Twitch recently grappled with harassment on its platform. Last month the company sued two users in the U.S. District Court for the Northern District of California for allegedly sending racist, antigay, sexist and violent messages and content to others. The company said these so-called hate raids violated its terms of service, traumatized some users and forced some off the platform, according to the complaint.
The hack wasn’t a first for Twitch. In 2015 the company said some users’ information might have been accessed without authorization, including passwords, email addresses , user names, home addresses, phone numbers and dates of birth. Twitch canceled the password of those who received the email, saying the passwords are encrypted but still could have been accessed.
Streamers on Twitch typically generate revenue through advertising, sponsorships and tips from viewers upon achieving certain viewership metrics. Twitch cuts special deals with its most popular streamers for additional income. Videogame publishers, including Electronic Arts and Activision Blizzard Inc., have paid these big names tens of thousands of dollars apiece to play their latest releases for a few hours on Twitch as a way to boost sales.
Twitch mainly competes with Facebook Inc. , Alphabet Inc.’s YouTube and, until last year, Microsoft Corp.’s Mixer. Microsoft closed Mixer after a little more than three years for failing to keep pace with rivals, even though it poached top streamers from Twitch such as Tyler "Ninja" Blevins, known for playing "Fortnite."
For the past several years Amazon has been working to develop its own videogames and integrate them into Twitch. The company has struggled to put out a hit, though recently it released a computer game that had a successful launch.
"New World" was among the most-played games on the Steam service when it was released on Sept. 28, attracting a peak of about 700,000 players. On Twitch, high-profile broadcasters such as Shroud played the multiplayer role-playing game, which retails for $49.99.
On Oct. 8, Mr. Bezos expressed his satisfaction with "New World" on Twitter. "After many failures and setbacks in gaming we have a success," he wrote on the messaging service. "So proud of the team for the persistence."