“We are writing to let you know that there may have been unauthorized access to some Twitch user account information.” The streaming company issued this announcement of potentially compromised accounts today, and as a precaution reset all passwords and stream keys. The exact nature of the security breach is still unknown but Twitch said it would contact affected users directly with additional details.
As a result of the possible hack, Twitch warns:
For your protection, we have expired passwords and stream keys and have disconnected accounts from Twitter and YouTube. As a result, you will be prompted to create a new password the next time you attempt to log into your Twitch account.
We also recommend that you change your password at any website where you use the same or a similar password. We will communicate directly with affected users with additional details.
I can confirm the above, as I was required to reset my password upon trying to log in to stream this morning, despite not having received an email addressing the issue. However, those whose accounts are thought to have been directly affected were sent the following email (via VentureBeat):
We are writing to let you know that there may have been unauthorized access to some of your Twitch user account information, including possibly your Twitch username and associated email address, your password, the last IP address you logged in from, limited credit card information (card type, truncated card number and expiration date), and any of the following if you provided it to us: first and last name, phone number, address, and date of birth.
PLEASE NOTE: Twitch does not store or process full credit or debit card information, so your card number is safe.
While we store passwords in a cryptographically protected form, we believe it’s possible that your password could have been captured in clear text by malicious code when you logged into our site on March 3rd.
Twitch also lists examples of and reminds account users that the password rating exists to create secure passwords in their blog post announcement. Be sure to keep these in mind as you reset your passwords.