NCSAM post 3: Twitch got breached, what can we learn?

Since I missed a day, I’m going to number these as post numbers now. This time, we’re talking about a breaking story as we taped the Security Box live Wednesday. The article Stolen Twitch source code, creator payment data revealed in apparent data leak is the article written during the same day.

For those who are not familiar with Twitch, the first short paragraph sums it up nicely on who they are.

Twitch, a subsidiary of Amazon, is a popular service that broadcasts esports, live music and other events to audiences that have numbered millions at a
time.

Another portion of another paragraph says:

An anonymous user of the message board 4chan — home to hackers and trolls alike — posted a 125-gigabyte torrent file that they allege includes all of Twitch’s code, including information about internal security tools, three years of payment history to Twitch “creators” and data related to proprietary software.

This number is not to sneeze at, 125GB is quite large, although not as large as some of our hard drives today.

Twitch did confirm the breach which I think is a first in quite awhile anyway.

This will be our first topic of next week’s show, appropriately because it broke during last week’s program and I didn’t look till after the program.

Lastpass tweeted out two tweets which are quoted within the notes, although adjustments to braille needed to be made as it uses symbols not known to braille.

Those tweets are:

LastPass, Worried about the #twitchleak? ? Step 1: Change your Twitch password. Step 2: Turn on Multi-Factor Authentication. Stay safe online this October (and beyond), and #BeCyberSmart. ? Via @VGC_News: https://bit.ly/3oFylYa a day ago, Khoros Publishing App

LastPass, The #Twitch leak is a good reminder to always be vigilant about your online security.
Whether you are/aren’t a Twitch user, here’s steps you can take to #BeCyberSmart: https://bit.ly/3iD3pUL a day ago, Khoros Publishing App

The time stamps mentioned here are the time from when the tweet was posted, and the client they used.

Were you affected by the Twitch breach, and what did you do? A quote said that using MFA and changing your password were not bad things to do, but the article did not say what was potentially taken.

Before I let you go, the article said they were working quickly to determine what happened, and more information would be forthcoming. If that happens and I’m alerted to it, I’ll update with more information when I get it.

Thanks so much for reading!