Loading story…
Twitch confirmed a major breach after a 125GB torrent was posted on 4chan containing what reporting described as the platform’s source code, commit history, internal security tooling, proprietary SDKs, and AWS-related services. The leaked data also reportedly included code for Twitch’s mobile, desktop, and console clients, assets tied to IGDB and CurseForge, and an unreleased Amazon Game Studios competitor to Steam. The dump was labeled “part one,” raising concern that additional company data could be released.
The breach also exposed creator payout records covering roughly three years, revealing earnings for top streamers and showing that dozens of creators had received more than $1 million from Twitch, with Critical Role reportedly leading the list at more than $9.6 million. Early reports said the leak did not appear to include user passwords or home addresses, though some reviewers claimed encrypted passwords were present, prompting advice for users to change passwords and enable multi-factor authentication. The anonymous leaker said the disclosure was intended to create disruption and competition in online video streaming and invoked criticism already surrounding Twitch’s handling of harassment and hate raids.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Twitch acknowledged that it had experienced a security breach after the leak became public. In response to the incident, users were advised to change their passwords and enable two-factor authentication as a precaution.
Media reports said the leaked data appeared to include Twitch's source code, commit history, internal security and AWS-related tools, SDKs, client code, and payout records for creators dating back to 2019, as well as data tied to IGDB, CurseForge, and an unreleased Amazon Game Studios project. Early reporting said user passwords and home addresses were not clearly included, though some users claimed encrypted passwords were present.
An anonymous poster released a 125GB torrent on 4chan containing data allegedly stolen from Twitch. The leaker described the release as intended to disrupt the online video streaming space and labeled it as "part one," suggesting more disclosures could follow.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
marketwatch.com
Open sourcetheverge.com
Open sourcenytimes.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers gained unauthorized access to a third-party customer service system used by Discord, resulting in the exposure of sensitive user data. The breach, which occurred on September 20, 2025, did not compromise Discord’s core infrastructure but targeted a helpdesk provider that managed customer support and Trust and Safety interactions. The attackers obtained personally identifiable information, including real names, Discord usernames, email addresses, and IP addresses of users who had contacted Discord’s support teams. In addition to contact details, the breach exposed partial payment information, such as the last four digits of credit cards and payment types, as well as purchase history for some users. Notably, a subset of affected users had submitted government-issued identification documents, such as driver’s licenses and passports, for account appeals or age verification, and these scanned IDs were also accessed by the attackers. The attackers demanded a ransom from Discord, threatening to leak the stolen information if their demands were not met, indicating a financially motivated campaign. Discord responded by immediately revoking the support provider’s access to its ticketing system, launching an internal investigation, and engaging a leading computer forensics firm to assist with remediation. Law enforcement agencies were also notified and involved in the investigation. The company publicly disclosed the incident and notified affected users, emphasizing that full credit card numbers and account passwords were not compromised. The breach highlights the risks associated with storing sensitive data, such as government IDs, in third-party systems, especially as regulatory requirements push platforms to collect more personal information for age verification. Security experts note that customer support platforms often become attractive targets for cybercriminals due to the concentration of sensitive user data. The incident underscores the importance of minimizing data retention and ensuring that sensitive information is not stored longer than necessary in support systems. Discord’s experience mirrors previous breaches at other major platforms where helpdesk systems were exploited to access user data. The company’s swift response aimed to contain the breach and prevent further unauthorized access. The exposure of government-issued IDs is particularly concerning, as it increases the risk of identity theft for affected users. The breach serves as a cautionary tale for organizations relying on third-party vendors to handle sensitive customer interactions. Ongoing investigations are expected to provide further insights into the attackers’ methods and the full scope of the compromised data. Discord has committed to reviewing and strengthening its data handling and vendor management practices in the wake of the incident.
Jun 29, 2026
Crunchyroll disclosed that a breach at a third-party service provider exposed the email addresses of roughly **6.8 million to 7 million subscribers**. Reports said the incident affected subscriber contact data rather than payment information or passwords, with the anime streaming company indicating the compromise occurred outside its own core environment. The exposure raised phishing and account-targeting risks for a large portion of Crunchyroll’s user base, as attackers could use the leaked addresses to impersonate the company or deliver credential-harvesting messages. Coverage of the incident described it as a major supply-chain style data exposure tied to a vendor, underscoring how breaches at external partners can affect millions of customers even when a company’s internal systems are not directly penetrated.
Jul 12, 2026
Thingiverse, the 3D-model sharing platform, suffered a data exposure that placed user information in the hands of hackers, with one report describing a **36GB cache of data** taken from the service. Reporting indicates the leak involved subscriber records and other user-related information from the MakerBot-owned platform, raising concerns that exposed account data could be used for credential abuse, phishing, or broader identity-focused attacks. Subsequent coverage said the incident affected **228,000 subscribers**, underscoring the scale of the breach and the sensitivity of the compromised dataset. The exposure drew attention to the security risks facing online maker communities and subscription platforms, particularly where large stores of user account information are retained and insufficiently protected against unauthorized access or exfiltration.
Jul 12, 2026