Zynga zynga.com Zynga data breach: what happened and what to do
In September 2019 attackers took player account data from Zynga, the maker of Words With Friends and Draw Something. Have I Been Pwned lists 172,869,660 accounts, with email addresses, usernames, passwords and phone numbers exposed.
View all 13,115 breaches- Breach date
- Sept 2019
- Made public
- 12 Sept 2019
- Affected
- 172,869,660
- Data exposed
- Email addresses, Passwords, Phone numbers, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Zynga, the game developer behind Words With Friends, Draw Something and FarmVille, had player account data stolen in September 2019. Have I Been Pwned (HIBP) lists a breach date of 1 September 2019 and added the data on 19 December 2019. HIBP counts 172,869,660 accounts.
What happened
Zynga acknowledged the incident after a hacker going by the name gnosticplayers went public with the data. Zynga said account login information for certain players of Draw Something and Words With Friends may have been accessed. It also said it didn't believe any financial information was accessed, and that it would take steps to protect those players' accounts from invalid logins.
The company's early wording pointed to certain players. The data HIBP later processed covers far more people: 172,869,660 accounts. The attacker had claimed a database of nearly 220 million accounts. HIBP's count is the one to rely on.
What was exposed
HIBP lists email addresses, usernames, passwords and phone numbers. Reporting on the breach says the passwords were stored as salted SHA-1 hashes, a method that is weaker than what's recommended today, so a determined attacker can crack many of them, especially short or common ones. Players who signed in through Facebook also had their Facebook ID exposed, and a phone number if they had given one to Facebook.
What that lets criminals do
Passwords are the main risk. If you used the same password on Zynga and elsewhere, a criminal can try that email and password pair on other sites, including email, shopping and banking logins. This is called credential stuffing, and it works because people reuse passwords.
Email addresses and phone numbers feed phishing and text scams. A message claiming to be from a game company, or about a locked account, is an easy pretext.
The company's response
Zynga said it was taking steps to protect affected accounts from invalid logins and believed no financial information was accessed. The breach is from 2019, so most of the practical damage from stolen passwords happens through reuse, not through the Zynga account itself.
If you played Zynga games
If you had a Zynga account in 2019, check your email on HIBP. If it appears, change the password on any site where you used the same one. Old gaming accounts are easy to forget, and a reused password there can be the weak link for something that matters more.
How to check your own exposure
Search your email address on Have I Been Pwned. If it appears in the Zynga entry, the question to ask is where else you used that password. Go through your email, banking, shopping and social accounts first, since those are the ones a criminal tries first. If your password manager flags reused or weak passwords, fix those at the same time. Old game accounts matter less on their own, but a six-year-old password can still be the one you use today with a number added at the end.
What to do if you were in it
- 1
Change your password and anywhere you reused it
Pick a new, unique password for the account, then change it on any other site where you used the same one. A password manager makes this quick. Start with your email and any financial accounts. Turn on two-factor authentication where it's offered.
- 2
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls with suspicion, especially ones that quote your name, phone number or the company. Don't click links in them. Go to the company's site yourself, or call the number printed on a card or a bill.
- 3
Use a unique password everywhere
A password manager creates and stores a different password for each site, so one old breach can't unlock your other accounts.
- 4
Check your connected Facebook login
If you signed in to a Zynga game with Facebook, review the apps connected to your Facebook account and remove ones you no longer use.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at Serus to see which breaches include your email address or phone number. Breach data can't be taken back once it's out, so the scan tells you what to change and where to stay alert.
Frequently asked
Was I affected by the Zynga data breach?
Check your email address on Have I Been Pwned. HIBP lists 172,869,660 accounts. A Serus free scan checks your email and phone number against this and other breaches.
What was exposed in the Zynga breach?
Email addresses, usernames, passwords and phone numbers, according to HIBP. Reporting says the passwords were salted SHA-1 hashes.
Should I change my password?
Yes, if you used your Zynga password anywhere else. Change it on those sites and turn on two-factor authentication.
Was financial information exposed?
Zynga said it didn't believe any financial information was accessed.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
