SecurityTwitchCreator Safety

40,000 Twitch Streamers Listed for Sale — and the Extension Story Underneath It

By Alex Reed·September 16, 2026·5 min read

Two different incidents are being reported as one. A dark-web listing advertised on September 9 claims data on roughly 40,000 Twitch streamers; researchers who examined a sample say it looks scraped, not breached. Separately, a browser extension with about 31,000 users was forwarding account tokens to attacker-controlled servers — and that one bypasses two-factor entirely. Twitch says neither originates from its systems.

If you only read one part

Go to twitch.tv/settings/connections, revoke anything you do not recognise, then log out all sessions. Changing your password without doing that first does not remove an attacker who already holds a token.

The List: What Is Actually In It

Cybernews examined a sample of 501 records from the advertised database and found usernames, profile links, email addresses, follower totals, verification status and some full legal names. Their assessment, quoted directly: “this indeed looks like a data scrape, not a breach” — although some of the email addresses were not publicly visible on the profiles, which raised the question of API abuse rather than simple page scraping.

Reported field	How sensitive
Usernames and profile URLs	Public already.
Follower counts and verification status	Public already.
Email addresses	Not public for most accounts — this is the part that matters.
Legal names	Present on some records. Pairing a real name with a channel is the real harm here.

“Just a scrape” sounds reassuring and is half right. No passwords are involved and nobody got into Twitch's systems. But a list that pairs a channel with a private email address and sometimes a legal name, sorted by follower count, is not a curiosity — it is a ready-made targeting list for sponsorship phishing, and unlike a password it does not expire when you change it.

The Extension: The Part That Can Actually Take Your Account

This is the more serious of the two and it is getting the smaller headline. Reporting names a Chrome and Firefox extension — “Twitch Enhanced Viewer | JeetBot”, roughly 31,000 users — that routed OAuth tokens through servers controlled by the attacker. Twitch has revoked exposed access tokens.

Why 2FA does not save you here

Two-factor protects the login. An OAuth token is what the platform hands out after you have already logged in successfully — it is a standing proof of identity. Whoever holds a valid token never sees the login form, so your second factor is never asked for. This is why “I have 2FA on” is not an answer to token theft, and why the fix is revoking access and ending sessions rather than changing a password.

The wider lesson is about what a browser extension actually is. An extension with permission to read Twitch pages sits inside your logged-in session with the same view your browser has. A viewer-count tweak, a chat enhancer, a “hide the sidebar” utility — all of them ask for the same access, and almost nobody reads the permission prompt. Extensions change hands and get sold; the one you vetted two years ago is not necessarily run by the same people today.

What Twitch Said

Twitch Support posted on September 14 that it is aware of reports involving a third-party browser extension, that the issue does not originate from Twitch systems, and gave a four-step checklist. It has not confirmed any breach of its own infrastructure.

Twitch Support on the third-party extension reports, September 14, 2026

The Checklist, in the Right Order

Order matters more than people expect. Revoking access before rotating credentials means a live session cannot simply carry on with the new password.

1Remove suspicious browser extensions. Anything that adds features to Twitch and is not from a source you can verify. This is the step that actually closes the hole — the rest is cleanup.
2Review third-party app access. twitch.tv/settings/connections lists every app and extension holding a token for your account. Revoke anything you do not recognise or no longer use.
3Log out all sessions. twitch.tv/settings/security → "Log Out All Sessions". This invalidates sessions an attacker may already be holding.
4Rotate credentials and turn on 2FA. New unique password, set up a passkey, enable two-factor. Do this after revoking tokens, not before — otherwise a live session keeps its access.

Expect the Sponsorship Emails

A list sorted by follower count with matching email addresses has one obvious commercial use, and it is not marketing. The standing pattern against streamers is a brand-deal approach with a contract or media kit attached — the attachment or the “download our brief” link is the payload, and the follower count in the email is what makes it feel researched and real.

Never open the attachment. Real agencies send a link to a document, and you can open a document in a browser without running anything.
Verify through a route you found yourself. Look the company up and contact them at the address on their own site — not the one in the email, and not a reply.
Urgency is the tell. A deadline of hours on a deal you never pitched for is a pressure tactic, not a business practice.

This is also the argument for keeping your channel's public contact separate from your personal inbox in the first place — something we cover in the channel setup guide, along with which personal details not to publish in panels.

Frequently Asked Questions

Was Twitch hacked in September 2026?

Twitch has not confirmed any breach of its systems, and said publicly on September 14 that the reports involve a third-party browser extension and that the issue does not originate from Twitch systems. Two separate things are being reported at once: a dark-web listing of roughly 40,000 streamer records that researchers believe was scraped rather than breached, and a malicious browser extension forwarding account tokens.

What data is in the 40,000-streamer list?

According to Cybernews, which examined a sample of 501 records, the listing contains usernames, profile links, email addresses, follower counts, verification status and some full legal names. Most of that is already public; the email addresses and legal names are not. Some of the emails were not publicly visible on the profiles, which is why researchers raised the possibility of API abuse rather than a simple scrape.

Which Twitch browser extension was stealing tokens?

Reporting names a Chrome and Firefox extension called "Twitch Enhanced Viewer | JeetBot", with roughly 31,000 users, which forwarded OAuth tokens through servers controlled by the attacker. Twitch has revoked exposed access tokens. If you ever installed it, revoking app access and logging out all sessions is not optional.

Does 2FA protect me if my OAuth token was stolen?

No, and this is the part worth understanding. Two-factor authentication protects the login step. An OAuth token is what the site issues after that step has already succeeded — it is proof you are you. Anyone holding a valid token can act as your account without ever seeing the login form, so a password change and 2FA alone do not evict them. You have to revoke the token and end the sessions.

What should I do if I am on the list?

Assume the email address tied to your channel is now known to people who also know your follower count and possibly your legal name. That combination is built for targeted sponsorship phishing. Turn on 2FA everywhere that email is used, never open an attachment from an unsolicited brand deal, and verify any sponsorship approach through a channel you found yourself rather than one the email gave you.

Is a scrape less serious than a breach?

For your account, usually yes — a scrape means nobody got into Twitch's systems and no passwords are involved. For you personally, not necessarily. A scraped list that pairs a channel with a real name and a private email is exactly the input a phishing campaign needs, and it does not expire when you change your password.