So this has been a week, hasn't it. Half the internet fell over on Monday when Facebook, Instagram and WhatsApp all vanished for something like six hours because of what basically amounts to Facebook locking itself out of its own building. Everyone and their cousin has already written that post though, so I'm not going to bother rehashing BGP routes and DNS records here. What I actually want to talk about is the thing that happened a couple days later and got buried under all that noise: the Twitch leak.
If you missed it, someone dumped a 125GB torrent of Twitch's internal data onto 4chan on Wednesday, and it is not a small leak. We're talking the entire site source code, going back to the Justin.tv days, plus internal tools, red team security notes, and — this is the part that actually made my jaw drop a little — three years of individual streamer payout numbers. Not aggregate stats. Actual names next to actual dollar figures.
I'll admit I spent a stupid amount of time last night scrolling through the spreadsheets people were pulling out of that torrent. Some of the numbers are wild. Multiple streamers apparently pulled in over $1 million from Twitch payouts across that window, and one (the Critical Role folks, if the numbers going around are accurate) reportedly cleared something like $9.6 million. I don't even watch that much Twitch anymore (I burned out on it around 2019, if I'm honest, right around when every stream started looking like a Red Bull commercial) but even I found myself doing the math on subscriber cuts and bit revenue for like forty minutes when I should've been asleep.
The other part of the leak that's more interesting to me than the money, honestly, is the reference to something called "Vapor." Buried in the internal docs is apparently a whole pitch deck for an unannounced Steam competitor, complete with a proposed launch library and revenue split numbers. Whether that ever ships is a different question entirely (plenty of internal Amazon projects die quietly and nobody outside the building ever finds out), but it's a genuinely strange thing to see leaked out in the open next to someone's stream key.
Twitch put out a statement acknowledging the breach and pointed to "an error in a Twitch server configuration change" that let a malicious third party get in. They're saying login credentials weren't fully exposed and that full credit card numbers weren't taken either, which is the standard reassurance every company gives after something like this, so take it for what it's worth. I don't think anyone's card number is the real story here anyway. The story is that a company can lose its entire codebase and years of confidential financial data to a single misconfigured server, and there's not a lot the rest of us can do about that except reset a password and move on with our day.
What strikes me, sitting here typing this on a Thursday morning with coffee going cold next to the keyboard, is how normal this has all started to feel. A massive outage on Monday, a massive leak by Wednesday, and by Thursday everyone's already onto the next thing. I remember when a breach like this would've been the only thing anyone talked about for a month. Now it's competing for attention with itself, basically, buried under a bigger story from three days earlier.
If you're a streamer and you're reading this: change your stream key even if Twitch says you don't strictly need to. It takes two minutes and there's no upside to leaving it as is when this much internal data is floating around torrent trackers with your username attached somewhere in a spreadsheet. I know that's not exactly the analysis piece some of the bigger tech sites are running today, with their charts and their "what this means for the platform economy" framing, but it's the actually useful thing I'd tell a friend if they asked me over lunch.
Anyway. Password managers exist for a reason. Use one, rotate what you can, and maybe don't build your entire income around a single platform's payout system if you can help it. Though I realize for a lot of these people that ship sailed years ago.