Amazon's Twitch hack exposes six-figure pay for top gamers

Twitch is the leading broadcaster of video gameplay, a livestreaming platform that attracts millions of viewers.
Twitch is the leading broadcaster of video gameplay, a livestreaming platform that attracts millions of viewers.PHOTO: AFP

NEW YORK (BLOOMBERG, NYTIMES) - An anonymous hacker attacked Amazon.com's video game streaming platform Twitch and earlier on Wednesday (Oct 6) leaked a trove of critical data including Twitch's source code and a spreadsheet detailing earnings for the platform's top gamers.

Leaks on the social media platform 4Chan, popular among conspiracy theorists and gamers, claim to include the entirety of the platform's Twitch.tv streaming history and an Amazon Game Studios product, still under development, designed to challenge Valve's dominant Steam storefront. Bloomberg has reported previously on Amazon's plans for a digital game store.

The 4Chan user who posted the 128GB of data said it was only the first part of the leak.

The leak also offers a glimpse into the wealth generated in the gaming sub-industry. A document listing Twitch's top earners shows gross earnings since 2019 reached US$9.6 million (S$13 million) for the platform's top account, CriticalRole.

The account, a set of voice actors, according to their Twitch page, generated an average of US$370,000 a year, according to the document.

The incident sent Twitch's community of streamers into a panic.

Ms Kaitlyn Siragusa, known to her 4.4 million followers as Amouranth, said in a text message that it was "quite shocking so much information could be breached".

Mr Saqib Zahid, who streams to his 2.8 million followers as Lirik, said in a Twitter direct message that the incident was "frustrating", but he was "not surprised".

Ms Natalia Mogollon, known as Alinity online, said via a Twitter direct message that her reaction was "disappointment".

And Mr Felix Lengyel, one of the top earners and most notable personalities on the platform, simply tweeted in all-caps under his username xQc: "HEY @TWITCH EXPLAIN?"

The list of top earners points to 13 accounts that have made more than US$108,000 a year and at least 80 who have collected more than US$1 million since 2019.

Some streamers confirmed their numbers were accurate - though others disputed the figures.

"All data in there on me is 100% true in terms of payout value info," tweeted Mr Scott Hellyer, a streamer who goes by tehMorag. "This is real and will impact people for years."

Another streamer, Mr Hasan Piker, anticipated people getting angry about the amount of money the list said he had made.

Twitch confirmed the breach and said it would provide updates when it has more information.

The hacker said the purpose of the leak was to "foster more disruption and competition in the online video streaming space", which he described as a "disgusting toxic cesspool", according to the 4Chan post reviewed by Bloomberg News.

Users on the thread applauded the hack for exposing the pay of top earners, who were accused of attempting to keep their profits secret. The leak even spawned a site - TwitchEarnings.com - that promises to let users sift through the stolen payments data or search for many of the thousands of Twitch handles by name.

"Anytime source code gets leaked it's not good and potentially disastrous," said Mr Ekram Ahmed, a spokesman at Check Point Software Technologies, a cyber-security firm.

"It opens a gigantic door for evildoers to find cracks in the system, lace malware and potentially steal sensitive information. I strongly recommend all Twitch users to exercise caution in the near-term ahead as cyber attacks are on the rise."

Twitch earned its share of scrutiny in September over the platform's mishandling of so-called hate raids. These occur when attackers or bots bombard an active livestream with messages in the victim's chat box, typically homophobic, racist or sexist content. Users boycotted the platform on Sept 1 for Twitch's lack of response to these hate raids.

Seattle-based Amazon acquired Twitch in 2014. Since then, it has tried to combine it with other Prime services, like Amazon Music and Prime Gaming, once called Twitch Prime.

Twitch is the leading broadcaster of video gameplay, a livestreaming platform that attracts millions of viewers. The company offers streamers a share of advertising revenue, and occasionally finds itself in bidding wars with rivals like Google's YouTube for the exclusive services of closely watched streamers.

"With 15 million daily users, Twitch holds significant amounts of data, much of which contains personal information about its customers," said Mr Danny Lopez, chief executive officer of Glasswall Solutions, a cyber-security firm, in a statement.

"It is essential that a proactive approach is taken to cyber security in order to protect such information. Once hackers have access to systems, there is little else that can be done."

In Singapore, the Cyber Security Agency said on Thursday in a Facebook post that "Twitch users are advised to change their passwords and enable two-factor authentication on their accounts immediately".