Your Twitch account was definitely hacked, here’s what we know so far

On October 7, Twitch confirmed that an enormous hacking incident took place. Large data sets including the platform’s private source code, unreleased projects, and how much streamers are getting paid were released to the public. 

While social media users thought Facebook’s massive whistleblower scandal was the top news story of the week, the cybercriminals outdid themselves to the point where it got everyone questioning, “how did it happen?” and “how bad is it?” 

While Twitch is still working its way into coming up with a concrete answer as to how it happened, security experts are warning of potentially terrible repercussions on the streaming platform.  

“Reading of a data breach that includes the entire source code, including unreleased software, SDKs, financial reports and internal red-teaming tools will send a shudder down [the spine of] any hardened infosec professional,” ThreatModeler founder and CEO Archie Agarwal told the Threatpost blog. “This is as bad as it could possibly be.” 

“The first question on everyone’s mind has to be, ‘How on earth did someone exfiltrate 125GB of the most sensitive data imaginable without tripping a single alarm?’ There’s going to be some very hard questions asked internally.” 

The streaming giant has only pointed the finger at an error to a server configuration, but according to The Verge, multiple sources claim that “the company valued speed and profit over the safety of its users and security of its data.” 

An employee who worked at Twitch from 2017 to 2019 spoke to The Verge on the condition of anonymity, describing the work atmosphere as negligible to the safety of users. 

“There would be constant questions and discontent about the regular moderation failures,” the source told The Verge, noting that Twitch’s management response was “very slow.” 

“If it wasn’t generating revenue, then it wasn’t valued as highly,” the source added 

Not only will this hacking incident reap dire consequences on Twitch, but it will also affect its parent company Amazon. 

According to The Verge, “the source notes that attackers can now see the shortcuts and APIs for internal Amazon services thanks to this leak. Because Amazon’s Prime Gaming offers revenue to streamers through subscriptions, the source warns it could be a fresh attack vector for hackers aiming to make money.” 

A number of sources described Twitch as a platform that does not prioritize safety. Even though Amazon acquired Twitch, the streaming platform was granted absolute control over its technological operation. Hence, Twitch utilized a bunch of third-party services that Amazon usually isn’t concerned with.  

“Twitch was on Slack before Amazon eventually adopted it, and two sources say Twitch has struggled to perform effective audits on the software and tools it has been using in the past,” The Verge added. 

With all this information in mind, it becomes clear why a configuration error resulted in the hack of over 8 million user accounts.  

This isn’t the first time Twitch faces a hacking incident. In 2015, the streaming platform battled with security issues that led to unauthorized access to Twitch accounts. However, this new incident saw worldwide attention due to its alarming size, forcing the streaming giant to address it quickly and publicly. 

“As the investigation is ongoing, we are still in the process of understanding the impact in detail,” Twitch said in a statement.  

Yet, as Twitch races to understand exactly how this happened, millions of people are now leaving the platform as the hacking incident proved that their security and safety is at risk any moment now.