Twitch fined 2 million lira in Turkey for the big 2021 hack

Data breach incidents have hit several big names in the tech industry in recent years. Twitch, the live streaming platform owned by Amazon, was among them. In 2021, the company suffered a hack that affected thousands of users. Now, Turkey has imposed a fine on Twitch for the data leak.

Turkey fines Twitch for massive data leak in 2021

The 2021 hack exposed data of thousands of people around the world. Among those affected by the breach, there were around 35,274 Turkish citizens. Therefore, the country’s data protection authority (KVKK) has imposed a fine of 2 million liras on Twitch, which is equivalent to around $57,600. The fine includes 1.75 million liras for insufficient security systems to keep its users’ data safe and 250,000 liras for not properly reporting the incident.

In 2021, the hacker responsible for the attack shared around 125GB of data from the live streaming platform’s databases. The leak took place on 4chan, the popular anonymous image board. The KVKK investigation concluded that Twitch “failed to take adequate security measures beforehand, addressing the issue only afterward.”

Twitch had already offered an official response on the matter at the time. The company attempted to minimize the issue by asserting that there was no breach of users’ login credentials. They also said that the credentials are encrypted and that bank details were not compromised either. “Twitch passwords have not been exposed. We are also confident that systems that store Twitch login credentials, which are hashed with bcrypt, were not accessed, nor were full credit card numbers or ACH / bank information,” a company spokesperson said.

The leak included users’ personal data

The hacker was reportedly an individual unhappy with the state of the Twitch community. The attack was an attempt to “foster more disruption and competition in the online video streaming space.” While the leaked data did not include user credentials or banking details, it did expose personally identifiable information (PII). The hacker also published the platform’s source code.