Twitch in crisis as it blames server error for massive data breach

The Twitch hack is real, it's massive, and security experts are aghast at the scale of the thing: "this is as bad as it could possibly be." The leak, which the hackers claim is only "part one," contains the site's source code, unannounced projects such as a Steam competitor, and the earnings of streamers.

Yesterday Twitch issued what was very much a holding statement, and has now expanded upon what it believes happened. Per the Twitch blog:

"We have learned that some data was exposed to the internet due to an error in a Twitch server configuration change that was subsequently accessed by a malicious third party. Our teams are working with urgency to investigate the incident.

"As the investigation is ongoing, we are still in the process of understanding the impact in detail. We understand that this situation raises concerns, and we want to address some of those here while our investigation continues."

That is, Twitch is putting this down to the human element: someone set up the company's servers incorrectly, and the hackers were able to find and access it. Whether this is human error or something more nefarious is unknown for now.

And the other thing this statement makes clear is that Twitch itself is still trying to understand just how bad this is.

Twitch notably doesn't say when this breach happened, though the data included in the leak goes back up to three years. Twitch's statement goes on to clarify that it believes personal data such as logins is not at risk, and emphasised that "full credit card numbers are not stored by Twitch, so full credit card numbers were not exposed." Whether the former can be taken at face value remains to be seen.

Finally, Twitch has reset all stream keys "out of an abundance of caution." Streamers can get their new key here.

Twitch will be in full crisis mode behind-the-scenes because, even if it's worked out what happened, that doesn't do anything about the fact it has happened—and what that means now and in the future. The repercussions are potentially enormous and elements of that are far beyond the control of even an Amazon-backed company.

"A lot more damage is now in store for Twitch," Candid Wuest from cyber-security company Acronis told the BBC. "The breach is already harming Twitch on all the fronts that count. [This leak] could contain nearly the full digital footprint of Twitch, making it one of the most severe data breaches of late. Releasing payout reports for streaming clients will not make the influencers happy either."

We'll keep you updated as this story develops. Meantime, do change your password and set up two-factor authentication.