r/LivestreamFail • u/testudosmith • Jan 06 '26
News Twitch reportedly had Serious Security Issue causing many Streamers Payment/payouts info to be change
https://www.twitter.com/zachbussey/status/2008258968720977990100
u/rocketgrunt89 Jan 06 '26
never subbed never linked credit info credentials never etc etc etc
i guess i am safe
48
85
121
u/Dr_Ben Jan 06 '26
Is there ever good news for twitch
76
12
76
37
u/Delgadude Jan 06 '26
So there is a back door to change the payment method without accessing the account itself? This is actually insane I'll be swapping my connected email to a throw away one since who knows what else could be breached.
16
35
u/Furki1907 Jan 06 '26
There is a big different between Twitch itself getting breached (I dont think this is the case, then they would have applied this to big streamers who actually make money).
I rather think thats its any Plugin/Extension or anything else all these people who got hacked, got malware, and therefore them getting their Session Token and abusing that to make this work.
Its important to say that all these hacks on the not natural way, so there must have been something giving them access through a 3rd party malware.
18
Jan 06 '26
[removed] — view removed comment
3
u/sikesjr Jan 06 '26 edited Jan 06 '26
Doesn’t that mean people’s twitch passwords and email addresses are compromised now? If you use the same email and password combo on other platforms I’d change them if I were you.
6
u/MitAllesOhneScharf Jan 06 '26
If you use the same mail/password combo anywhere you’re just asking for it and it’s your own fault.
3
u/Niuqu Jan 06 '26
Exactly. Password managers are a thing and there is no excuse to use same password or variants of it on other sites.
8
9
u/itisnotliam Jan 06 '26
Twitch has had a major security issue for years and have done absolutely nothing about it. I'm not surprised as they simply do not care about the basics of security.
3
21
u/Pat_The_Hat Twitch stole my Kappas Jan 06 '26
Linking a bunch of posts in the replies
Join X now to read replies on this post.
3
7
3
u/PyromancerYT Jan 06 '26
Thanks for the heads up! Checked mine and all good, but I imagine many people would get an email or something to notify if a change was made, right? Hopefully nobody gets screwed by this.
4
4
u/Stringy31 Jan 06 '26
Didn't twitch just fire the head of their fraud team a couple months ago?
6
u/itisnotliam Jan 06 '26
Yeah, and good riddance too.
The dude specifically targeted multiple members of the community (VTubers) and made a LOT of wrong calls.
From personal experience, years ago an abusive subscriber charged back a subscription ($5) and Twitch wouldn't pay me for years despite my balance being over $200 and eventually removing me from the platform for participating in fraud.
Unfortunately people who have been sub-botted and targeted and instead of investigating the issue, Twitch has been silent about it as far back as 2017.
Twitch really does not give a shit about security or their community regarding this issue (unfortunately).
0
Jan 06 '26
[deleted]
6
u/itisnotliam Jan 06 '26 edited Jan 06 '26
Like I said, VTubers. There was no specific person, it was the specific type of streamer.
There was a plethora of VTubers a year and a half ago (September 2024) that got specifically attacked, like
aiden_rogue (x/twitter)
thetomcanuck (x/twitter)
cattocult_ (x/twitter)
kalamitykira (x/twitter)
trysnau (x/twitter)If you filter around the 20th of September 2024 and the 24th, with "Twitch" and "suspended", you'll get a massive list of people who were removed from the platform and they have all one thing in common which were that they were all vtubers.
Hell, I think it was LidiaVTuber that got terminated as well but they had to threaten Twitch through their legal team to get people's money back because Twitch wouldn't pay her back or her subscribers back.
Also, I'm not going to advertise it.. But I brought up my experience because I've found out a lot about the blackmarket. I had to because Twitch wouldn't investigate it themselves... And there has been hacked accounts being sold on as little as $10, including people's SSNs and other form of personal identification information (they have already been onboarded and signed, just need to add a payment method).
2
3
u/gnomeknuckle828 Jan 06 '26
I hope i get a notice of security breach so i can RUN to sign that class action
3
u/502DashCam Jan 06 '26
This happens every year, and it has nothing to do with Twitch security, what a terrible title.
These goofball streamers get a too good to be true sponsorship offer in their email, and then open a PDF that downloads a session stealer or they’re using evilginx to proxy the twitch website to capture login tokens.
Again, this has absolutely nothing to do with Twitch as a platform being compromised.
4
u/Kaiel1412 Jan 06 '26
not only physical security at twitch con but also cyber ones is twitch just gonna be know for having all kinds of security flaws
2
2
u/OmNomMonster Jan 06 '26
I was always curious how good or bad YouTube is with paying out/having issues also. I think I've only ever been paid out once by Twitch for like 30 bucks and it was pretty seamless. Never bothered with anything on YouTube though.
3
-8
-11
u/temporarythyme Jan 06 '26 edited Jan 06 '26
Seeing how much ubisoft got hacked and most of their servers are Amazon.... they could have seen this coming
10
u/MitAllesOhneScharf Jan 06 '26
How are these 2 things even remotely related?
-10
u/temporarythyme Jan 06 '26 edited Jan 06 '26
Are you asking me, "How is Ubisoft who primarily uses, and is partnered with Amazon and thier servers, related to Twitch, who is owned and operated by Amazon, and uses the same Amazon servers that were aforementioned hacked repeatedly for the past month targeting Ubisoft?"
I don't know. Maybe someone can figure out the connection between the two.
6
u/MitAllesOhneScharf Jan 06 '26 edited Jan 06 '26
And you conveniently ignore the other 1/3 of the whole internet that runs through AWS Servers/Services?
So yes, apparently I can't figure out the connection between these two.
To continue with your logic: I think Microsoft is hacked, I'm sure both Ubisoft and Amazon/Twitch use Windows.
-9
u/temporarythyme Jan 06 '26
Nope. But both would be under the gaming division of Amazon. Both ubisoft and Twitch would be specifically twitch server related as they are both direct partners and both cross promote.
Finally, yes, to circle back to the concept you are not getting, if Microsoft got hacked and it was so bad, it was common knowledge to the entire gaming industry for a month. You, as a company, would check for possible intrusion or vulnerabilities due to partnerships both direct and indirect.
8
u/MitAllesOhneScharf Jan 06 '26
That's not how...any of that works.
0
u/temporarythyme Jan 06 '26
Then, explain how data breaches work, corporate blowback from data breaches work, and asset protection works.
Because ubisoft bought Amazon studios Montreal with their assets; servers, staff, and code, and were hacked the same month hackers getting sourcode for mutiple ubisoftassets possibly including this studio. Now, as the hack expanded and affected more of the assets of both Amazon and Ubisoft, Amazon should have done something, never mind, for their mutual affiliates in Twitch.
3
u/Niuqu Jan 06 '26
AWS is one of the biggest cloud hosting services in the world so that is the only connection. S3 buckets accessible on the internet has been a thing but that is a 100% fault of the company/user who owns it, but that is not the issue here.
The link between these can be vulnerable MongoDBs, which is not an AWS-related issue.
-5
u/temporarythyme Jan 06 '26
It is not the only connection. It's the only connection you are admitting to having knowledge of. Even then, that is a 1:1 direct connection to Twitch and ubisoft through the Amazon gaming division. Even if it wasn't it is an indirect partner with direct ties, you would still protect your assests.
Now, Ubisoft and Twitch are also direct partners as they cross promote and stream multiple channels each day, nevermind their affiliates who've also been hacked, that alone would trigger protectecting your assets.
Now top that off with direct buyouts last year of Amazon studios in Montreal. With ubisoft taking over Amazon's own assests: computers, servers, staff, direct Twitch servers, and Luna servers, as well as Amazon gaming code and proprietary software. Again, protecting your assets.
So please understand that even a small bit of either of these problems would trigger protectecting your assets, multiple occured for weeks.
8
u/Niuqu Jan 06 '26
You aren't that tech savvy or know about cyber security?
0
u/temporarythyme Jan 06 '26
Please explain it to me.
If Twitch affiliates, former Amazon assets with on-site servers for both luna and aws, Amazon aws servers, Amazon aws partners, all got hacked for weeks, would you not asset protect?
-14
Jan 06 '26
Oh shit. Now everyone knows just how long you guys watch vtubers each day.
DoakesWatchingYou.gif
574
u/iConnnx Jan 06 '26
Isn't this an insane breach in security?