Twitch: one server misconfiguration leaked its source code and creators' payouts

On October 6, 2021, an anonymous user posted a torrent of roughly 128GB to 4chan: 'the entirety' of Twitch, including source code from nearly 6,000 internal Git repositories, plans for a Steam competitor code-named 'Vapor', mobile and desktop clients, and payout records covering almost 2.4 million streamers since August 2019. The poster called it 'part one' of a larger release.

Twitch confirmed the breach within a day. The company attributed the intrusion to a server configuration error that a malicious third party had exploited, said it found no indication that login credentials or credit-card data were taken, and reset every stream key on the platform as a precaution. But the payout data was authentic — news outlets ranked the platform's top earners from it, starting with Critical Role at $9.6 million and xQc at $8.5 million a year, and the numbers turned Twitch's own economics inside out for everyone to see.

The leak landed in the middle of a creator revolt. Months earlier, streamers had staged the #ADayOffTwitch boycott over the platform's 50/50 subscription split and weak moderation. Now the company's code, roadmap and payroll were public, and its roughly $9.6 million-a-year best sellers sat next to a long tail earning a fraction of that — a portrait Twitch would have never chosen to publish.

Source code for ~6,000 internal repos exposed; payouts to 2.4 million streamers published; all stream keys reset; top-earner pay gaps became public.

Server configuration changes were not gated by the same review discipline as code deployments, so one bad setting exposed production data stores.

Source code, unreleased product plans and creator payout records lived behind the same misconfigured door — no segmentation between the crown jewels.

The payout records were the most damaging asset: the company had fought revenue-split demands privately, and the leak published its own negotiating position.

A misconfigured server is not a small bug when your codebase and your users' payroll ride on it. Source code, secrets and payout records need the same hardening as logins.

Twitch reset stream keys platform-wide and told creators to stay alert for phishing waves impersonating the company. The published pay table fed straight into the ongoing revenue-split fight, and in September 2022 Twitch president Dan Clancy announced improved subscription revenue terms for top streamers — a concession the leak's aftermath helped force. For Amazon, the exposure of nearly 6,000 internal repositories turned a routine configuration review into a multi-year security rebuild of the platform it had bought for almost $1 billion in 2014.