Twitch: No Passwords Were Taken in Data Breach

A large breach at 1 of the world’s major gaming platforms earlier this month may not be as terrible as initial thought, with the business declaring that no passwords were being uncovered in the incident.

Security authorities roundly criticized Amazon-owned Twitch after an anonymous person posted a 125GB torrent website link to 4Chan, and claimed to have leaked every digital property owned by the agency.

Nonetheless, in an update on Friday, Twitch claimed that consumer passwords were being not impacted.

“We are also self-assured that methods that retail outlet Twitch login credentials, which are hashed with bcrypt, ended up not accessed, nor have been entire credit score card quantities or ACH / financial institution facts,” it included.

“The exposed information mainly contained paperwork from Twitch’s source code repository, as effectively as a subset of creator pay-out details. We’ve gone through a thorough assessment of the information and facts bundled in the files uncovered and are self-confident that it only influenced a compact portion of people and the consumer impact is minimal. We are making contact with those people who have been impacted specifically.”

At the time, the attacker claimed to have all of the firm’s resource code cell, desktop and console purchasers proprietary SDKs and inside AWS solutions and “every other property” it owns, like IGDB, CurseForge and an unreleased Steam competitor, dubbed “Vapor.”

Also reportedly compromised were pink teaming applications utilised by the Twitch’s SecOps function and information and facts on how a great deal the firm compensated its most well-known streamers.

That prompted some to argue the incident was “as undesirable as it gets” from an infosecurity perspective. Some others were dumbfounded that an unique could have stolen so a lot delicate information devoid of location off any inner alarms.

While only a tiny quantity of consumers show up to have been impacted by the incident, the scale of the IP breach would however point out that Twitch’s security posture was not up to par. 

The unauthorized third party in issue was equipped to accessibility the info immediately after a server misconfiguration, in accordance to Twitch.

Some components of this posting are sourced from:
www.infosecurity-magazine.com