Twitch Data Leak: What It Means for Users

In October 2021 a huge Twitch data leak appeared online. It was mostly company data and streamer payouts, but Twitch still told users to protect their accounts.

By Siddharth ShankarUpdated October 19, 2026

The Twitch leak was unusual because it was not mainly a list of user passwords. It was a large dump of internal company material. That still mattered to streamers and to ordinary viewers, so it is worth understanding what was and was not involved.

What happened

According to Tom’s Guide, an anonymous 4chan post linked to the data early on October 6, 2021. Twitch responded later that day and updated its post on October 7. Twitch said the data was exposed because of an error in a server configuration change and was then accessed by a malicious third party.

What was reportedly in the leak

The reported contents, which were not all independently verified, included:

• A 125GB data stash with source code and financial information
• Streamer payout data going back to 2019
• Source code from almost 6,000 internal Git repositories, including Twitch’s desktop, mobile and console clients
• Code for other Twitch-owned properties
• A reported Steam competitor from Amazon Game Studios
• Internal security testing tools

What Twitch said about passwords and cards

Twitch said, “At this time, we have no indication that login credentials have been exposed.” It also said full credit card numbers were not exposed because Twitch does not store them in full. One Twitter user claimed the data included encrypted passwords, but nobody else who saw the data confirmed this.

What users were advised to do

• Change your Twitch password, make it unique and strong.
• Turn on two-factor authentication.
• If you are paid through Twitch, check activity on the account that receives payouts and use the strongest security available.
• Be cautious about unexpected messages or requests.

Twitch also reset all stream keys, and some streamers needed to update their client software manually.

Why a leak without passwords still matters

Payout data can reveal how much a streamer earns, and source code can help attackers find weaknesses. That can lead to targeted scams and phishing aimed at streamers. Viewers face less risk, but a reused password is a risk on any site, so the leak was a good prompt to fix it.

If you stream for a living

Streamers had the most to lose. Secure the account that receives your payouts, use an authenticator app for two-factor authentication on Twitch and on your email, and treat any message about sponsorship deals, payments or account problems as suspect until you confirm it through a channel you trust. Twitch reset all stream keys after the incident, so make sure your streaming software has the new key.

If you only watch

Viewers face a lower risk, but the same basics apply. Use a unique password, review any apps connected to your account and check your account’s security settings. If you saved a payment method, watch your statements for charges you do not recognise.

Bigger picture

Not every breach is about passwords, but most leave someone exposed to a scam. See what a data breach is and how it happens and data breach statistics.