When something goes wrong, it is written down here.

What happened

SparkStream's server and database are hosted by Railway. On 21 October 2026 Railway found that an attacker had got into the part of its systems that stores its customers' settings, including the access keys those customers use to reach other services. Some of those keys were read in plain text.

Railway first believed the attack was aimed at AI companies on its platform. On 23 October it told us that our workspace matched what the attacker searched for, though it could not say whether our keys were read. That made no difference to what we did: we had treated every one of our keys as exposed from the start, including the keys for payments, email, Discord, Twitch and GitHub, the password to our database, and the key we use to encrypt data we store.

Railway's notice reached us at 01:50 UK time on 22 October.

Timeline

All times are UK time on 22 October 2026 unless stated.

The gap between replacing the keys at 03:30 and using them at 18:03 is because Railway paused all deployments while it dealt with the attack. The cancelled payment, email, Discord, Twitch and GitHub keys stopped working at 03:30 regardless, so nobody could use them after that. The database password and the encryption key could only be changed once deployments resumed, which is why they follow in the evening.

What was and was not at risk

Not at risk, by design:

• Card details. We never hold them. Payments are handled by Stripe.
• Passwords. We do not have any. You sign in with Twitch.
• Direct messages and Cloud Sync data. These are encrypted on your own computer with keys that never leave it. Nobody can read them from our side, including us.
• Your own keys for other services, such as an ElevenLabs key, a Discord webhook or a Spotify sign-in. These are stored only on your computer and never sent to our server.
• Everything SparkStream does on your computer: your rewards, overlays, sounds and settings.

Within reach of someone holding every exposed key and able to reach our database:

• Account details: your Twitch name, your email address if you gave one, and your subscription status.
• Support tickets and community posts, which are stored encrypted.
• For streamers who use Analytics: the display names of viewers who redeemed their channel point rewards, stored encrypted, with what was redeemed and when.

No evidence was found that anyone reached any of it (see below).

What we did

1. Cancelled and replaced every exposed key at the service it belongs to. The old keys no longer work anywhere.
2. Replaced our encryption key and encrypted everything we store again under the new one, so the old key opens nothing.
3. Changed our database password and made the database private, so it can only be reached from inside our own hosting network, never from the internet.
4. Removed keys we were not using instead of replacing them, so there is less to protect.

Replacing the keys briefly stopped the SparkStream chat bot answering in chat for part of 22 October. Everyone was signed out once and asked to sign in again on the website and the Panel.

What we checked, and what we found

We went through the records of everything the exposed keys could unlock. We found no sign that any of them was used by anyone but us.

One limit, stated plainly: a database sign-in that succeeded with the correct password is not recorded, so a read could leave no trace. The network traffic above is why we believe none happened.

Who we told, and the compensation

• Every SparkStream user, on 22 October, in the app and by email, with what happened, what we did and what it meant for them.
• The Information Commissioner's Office, by phone on 22 October. Our assessment was that a formal report was not required, because there was no evidence of harm and the data within reach was low risk, and the ICO's helpline said a report was likely not needed. We told them anyway.
• Viewers whose display names were in Analytics cannot be contacted: we hold no contact details for them, only their encrypted display name. This page is for them too.

Compensation: every account with Pro was given 7 extra days, for the hours the chat bot was down. We gave it without being asked.

What we are changing

• Our database stays private. It will not be reachable from the internet again.
• Fewer keys, each doing less. Keys we do not use are removed, not kept in case, and we are narrowing each remaining key to only what our server needs.
• Viewer names readable only on the streamer's computer. We are looking at changing Analytics so viewer display names are encrypted with a key that never reaches our server.
• A way to reach you when our own systems are down. Telling users this time depended on our own server. We are building a signed notice that the app checks for on services that do not depend on our hosting, so we can always tell you what is happening.

If you ever spot something on your account that you did not do, open a support ticket in the app or email hello@sparkstreamapp.com.