Twitch Accounts Hit in New Breach Wave: Is Your Account Safe?

By Kim Njuki April 29, 2025 Updated: October 17, 2026 3 min read

Reports surfaced in mid-April 2026 of Twitch account credentials being offered in bulk on dark web markets and Telegram channels specializing in stolen account data. Based on threat intelligence analysis of the circulating dataset, this does not appear to be a new Twitch breach — the data is consistent with compiled credential stuffing lists combining the 2021 Twitch data incident with subsequent gaming platform breach compilations.

That distinction matters for how you respond — but it doesn't change what you need to do to your account.

What's Circulating and Where It Came From

The current dataset appears to be a combination of:

• The October 2021 Twitch breach, which exposed 125GB of data including source code and partial user data
• Credential stuffing lists built from gaming platform breaches (various 2023-2025 incidents)
• Freshly acquired credentials from phishing campaigns targeting Twitch streamers and viewers

The combination is being packaged and sold as "fresh Twitch access" — which is misleading, since much of the underlying data is years old. However, credentials that were valid in 2021 may still be valid today if the account owner hasn't changed their password since the incident.

How to Check If Your Account Is Exposed

Have I Been Pwned (haveibeenpwned.com) indexes breach data and can tell you if your email address appears in known breach compilations. Check the email address associated with your Twitch account.

Twitch's own login activity. Log into Twitch and navigate to your Security and Privacy settings. Review authorized connections and recent login activity. Any session you don't recognize should prompt an immediate password change.

Check if your Twitch credentials appear in credential stuffing databases. Services like Dehashed and Snusbase allow searching for compromised credentials, though they require subscriptions. For most users, Have I Been Pwned is sufficient.

Immediate Steps to Secure Your Twitch Account

Change your password immediately. Use a password manager to generate a unique, randomly generated password for Twitch that you use nowhere else. If you've reused your Twitch password anywhere, change it everywhere.

Enable two-factor authentication. Twitch supports TOTP authenticator apps. Enable this in Security and Privacy settings. Remove SMS as a backup option if it's currently configured.

Disconnect unused third-party application authorizations. In Twitch's Security and Privacy settings under "Connections," you'll see a list of applications authorized to access your Twitch account. Revoke access for any you no longer use or don't recognize.

Review your channel settings if you're a streamer. Check your channel's moderation settings, AutoMod configuration, and channel editor permissions. Attackers who compromise a streamer's account may modify these settings to exploit their community.

Set up Twitch's login notification. Enable email notifications for new device logins in your notification settings. This gives you early warning of unauthorized access attempts that succeed.

If Your Account Is Already Compromised

If you discover unauthorized access, use Twitch's account recovery process at twitch.tv/user/account-recovery. You'll need access to the email address associated with the account. If the attacker has changed the email, contact Twitch support directly and provide as much account history as possible to verify ownership — original creation date, previous usernames, streaming history.

For affiliate and partner accounts, Twitch has a dedicated creator support escalation path. Contact them through the creator dashboard rather than the general support queue.