Twitch leak includes source code and creator payouts

Twitch, Amazon’s incredibly popular game streaming service, has apparently been the target of a massive hacking operation that includes the system’s source code, user data (including payouts), and plans for an unreleased digital store.

An anonymous post on the 4chan message board released a 125GB torrent with the data, which the hackers claim is the entirety of Twitch’s code and history. Twitch confirmed the leak in a tweet.

We can confirm a breach has taken place. Our teams are working with urgency to understand the extent of this. We will update the community as soon as additional information is available. Thank you for bearing with us.
— Twitch (@Twitch) October 6, 2021

Twitch did not immediately reply to Fortune’s request for comment.

The hackers claim that the leaked data includes:

Twitch’s comment history “going back to its early beginnings”
Creator payout reports for the past three years
Complete source code for the mobile, desktop, and console Twitch clients
An unreleased competitor to the Steam digital distribution service, code-named Vapor
Code for proprietary software development kits and internal Amazon web services used by Twitch
Data from other Twitch services, including IGDB and CurseForge
Twitch internal security tools

The hacker also suggests more data could be forthcoming.

Assuming the data is accurate, it’s an eye-opening look at what Twitch’s top streamers earn from the service. (Additional income, such as merchandise, user donations, sponsorships, and revenue from other streaming services is not included.) The top streamer earned $9.6 million between August 2019 and October 2021. The top 10 collectively took in more than $50 million.

Twitch is the top game-streaming site, with an average viewership of 2.5 million people at any given time. It has 7 million creators who stream each month, with a total audience of over 30 million per day. Last year, the service says, people watched over 1 trillion minutes of content (the equivalent of 1.9 million years).

As a precaution, users should consider changing their passwords and enabling two-factor authentication on their accounts.

Updated to include confirmation of the leak from Twitch on Twitter at 1:08 p.m. ET on Wednesday, Oct. 6, 2021.