<story><title>Twitch is hacked, and its source code leaked</title><url>https://kotaku.com/report-twitch-is-hacked-and-its-source-code-is-in-the-1847808252</url></story><parent_chain><item><author>madrox</author><text>There were no encrypted password dumps. No production secrets were leaked (according to the article). What&amp;#x27;s here is no more than what your average Twitch engineer has access to.&lt;p&gt;Yes, that included payout data. Anyone with &amp;quot;staff&amp;quot; access to the site (which any employee can have) has access to any streamer&amp;#x27;s dashboard, which includes payout data.&lt;p&gt;I don&amp;#x27;t think this was an attack. Based on the data so far I think it was a disgruntled engineer. Obviously if more gets leaked later I may revise that opinion.</text></item><item><author>nemothekid</author><text>This is a pretty thorough and high profile hack on a major tech company - this isn&amp;#x27;t something I&amp;#x27;d expect from an Amazon owned property. The hack (allegedly, I haven&amp;#x27;t downloaded it) includes&lt;p&gt;* Entire git histories&lt;p&gt;* Internal&amp;#x2F;Private AWS SDKs&lt;p&gt;* Encrypted Password dumps and payout reports&lt;p&gt;It&amp;#x27;s so comprehensive I&amp;#x27;m very curious into how an attacker got that level of access. I can&amp;#x27;t think of another, large, corporate web 2.0 startup who&amp;#x27;s gotten owned in a similar fashion. Could the same attack work on Amazon? YouTube?&lt;p&gt;It&amp;#x27;s also strange that someone who has this level of access to what is presumably a multi-billion dollar company decided to just leak the data? Maybe they did try to ransom it, but I&amp;#x27;d imagine someone with this kind of access inside Twitch must have had some creative way of making money.</text></item></parent_chain><comment><author>ergerger</author><text>I also worked for Twitch and can confirm what you&amp;#x27;re saying is true. These repo&amp;#x27;s any staff member had access to - including non-engineering staff.&lt;p&gt;Revenue for the longest time was as simple as navigating to a streamers dashboard as staff, but they did finally gate that away from staff who don&amp;#x27;t need to see that info, however I am sure there are other ways to obtain revenue reporting info.&lt;p&gt;I am assuming all data - including personal - has been compromised but so far, the data leaked is data that most staff would have access to in some way or another. Some may find that shocking, but this was not a &amp;quot;high level hack&amp;quot;</text></comment>
<story><title>Twitch is hacked, and its source code leaked</title><url>https://kotaku.com/report-twitch-is-hacked-and-its-source-code-is-in-the-1847808252</url></story><parent_chain><item><author>madrox</author><text>There were no encrypted password dumps. No production secrets were leaked (according to the article). What&amp;#x27;s here is no more than what your average Twitch engineer has access to.&lt;p&gt;Yes, that included payout data. Anyone with &amp;quot;staff&amp;quot; access to the site (which any employee can have) has access to any streamer&amp;#x27;s dashboard, which includes payout data.&lt;p&gt;I don&amp;#x27;t think this was an attack. Based on the data so far I think it was a disgruntled engineer. Obviously if more gets leaked later I may revise that opinion.</text></item><item><author>nemothekid</author><text>This is a pretty thorough and high profile hack on a major tech company - this isn&amp;#x27;t something I&amp;#x27;d expect from an Amazon owned property. The hack (allegedly, I haven&amp;#x27;t downloaded it) includes&lt;p&gt;* Entire git histories&lt;p&gt;* Internal&amp;#x2F;Private AWS SDKs&lt;p&gt;* Encrypted Password dumps and payout reports&lt;p&gt;It&amp;#x27;s so comprehensive I&amp;#x27;m very curious into how an attacker got that level of access. I can&amp;#x27;t think of another, large, corporate web 2.0 startup who&amp;#x27;s gotten owned in a similar fashion. Could the same attack work on Amazon? YouTube?&lt;p&gt;It&amp;#x27;s also strange that someone who has this level of access to what is presumably a multi-billion dollar company decided to just leak the data? Maybe they did try to ransom it, but I&amp;#x27;d imagine someone with this kind of access inside Twitch must have had some creative way of making money.</text></item></parent_chain><comment><author>twistedpair</author><text>So much for information compartmentalization. Does the typical engineer need access to payment details for their daily work?</text></comment>