OMGPOP Data Breach (2013): What Was Exposed & What To Do

In 2013, OMGPOP, the company behind the mobile game Draw Something, experienced a data breach that exposed email addresses and passwords belonging to approximately 7.1 million individuals. The incident remained largely unpublicized at the time but surfaced again when the data appeared in leaks circulating in 2019. Such events illustrate how credentials collected years earlier can re-emerge in public data sets, extending the period during which affected accounts remain potentially vulnerable.

Breaking down the breach

The available records indicate that the breach took place around 2013 and involved the exposure of more than 7 million email address and plain-text password pairs. No further technical details, such as the method of intrusion or the precise date of discovery, have been disclosed in public reporting. The data later appeared in circulation in 2019, which is when the incident received renewed attention.

How a breach like this happens

Incidents involving the exposure of user credentials often begin with attackers gaining access to an organisation’s systems through vulnerabilities in web applications, weak authentication controls, or compromised third-party services. Once inside, an attacker may locate databases that store account information. When passwords are kept in plain text rather than hashed, the entire set of credentials can be copied and later distributed. The time between the initial compromise and any public disclosure can vary widely, and in many cases the first sign of a breach appears only when the data surfaces elsewhere.

Who is OMGPOP?

OMGPOP developed the mobile game Draw Something, which gained widespread popularity in the early 2010s. The company was previously known as i’m in like with you, or iilwy, and was later acquired by Zynga. Organisations of this type maintain user accounts to support gameplay features such as friend connections and progress tracking, which requires the collection of email addresses and passwords.

What data was at risk

The breach is reported to have exposed email addresses and passwords stored in plain text. Public information does not specify whether additional categories of data were involved. Companies in the online gaming sector commonly hold user identifiers, account creation dates, and limited profile information, yet the exact contents of the OMGPOP data set remain unconfirmed beyond the two data types already named.

What's at stake

Individuals whose email addresses and passwords were exposed face the possibility that those credentials could be tested against other online services, particularly if the same password was reused. For the organisation, the incident highlights the long-term consequences of storing passwords without cryptographic protection. Both users and the company may encounter repeated attempts to access accounts over an extended period after the data becomes public.

Were you affected?

Anyone who created an OMGPOP account around the time of the breach should consider changing passwords on that service and on any other sites where the same credentials may have been used. Enabling multi-factor authentication where available adds a further layer of protection. Readers can also run a free exposure scan of their email address against known breach data sets to check for additional exposures.

AICompiled with AI assistance from public sources and published under our editorial standards.