Twitch: No Passwords Were Taken in Data Breach

A substantial breach at a person of the world’s major gaming platforms earlier this month may not be as negative as to start with imagined, with the organization professing that no passwords ended up exposed in the incident.

Security authorities roundly criticized Amazon-owned Twitch after an nameless person posted a 125GB torrent backlink to 4Chan, and claimed to have leaked each and every electronic home owned by the business.

Nevertheless, in an update on Friday, Twitch claimed that user passwords have been not impacted.

“We are also assured that systems that keep Twitch login credentials, which are hashed with bcrypt, had been not accessed, nor have been total credit card numbers or ACH / lender info,” it added.

“The exposed knowledge mostly contained paperwork from Twitch’s resource code repository, as nicely as a subset of creator fork out-out information. We have been through a extensive assessment of the information and facts included in the data files exposed and are confident that it only influenced a small portion of buyers and the shopper influence is negligible. We are getting in touch with individuals who have been impacted specifically.”

At the time, the attacker claimed to have all of the firm’s source code mobile, desktop and console consumers proprietary SDKs and interior AWS products and services and “every other property” it owns, such as IGDB, CurseForge and an unreleased Steam competitor, dubbed “Vapor.”

Also reportedly compromised have been crimson teaming resources applied by the Twitch’s SecOps operate and info on how considerably the company paid out its most well-liked streamers.

That prompted some to argue the incident was “as bad as it gets” from an infosecurity perspective. Other folks have been dumbfounded that an specific could have stolen so much delicate data with no setting off any internal alarms.

Despite the fact that only a little range of customers look to have been impacted by the incident, the scale of the IP breach would still reveal that Twitch’s security posture was not up to par. 

The unauthorized 3rd get together in question was able to entry the details soon after a server misconfiguration, according to Twitch.

Some parts of this article are sourced from:
www.infosecurity-magazine.com