Zynga Data Breach (2019): What Was Exposed & What To Do

People whose accounts were created with Zynga services may now face increased risk of targeted phishing, credential reuse on other sites, and unwanted contact through exposed phone numbers. The scale of the incident means these possibilities affect a large number of individuals who played the company's games. In September 2019, Zynga reported a data breach that affected 172.9 million people. The exposed records included email addresses, usernames, phone numbers, and passwords stored as salted SHA-1 hashes. The data set was later provided to Have I Been Pwned by dehashed.com.

Inside the incident

The breach was made public on 1 September 2019. Available records state that 172.9 million unique email addresses were involved, together with the associated usernames, phone numbers, and hashed passwords. No further information on the method of access, the exact date of the intrusion, or the duration of unauthorized activity has been disclosed in public reports.

How a breach like this happens

Incidents involving large user databases often begin with an attacker obtaining remote access to an application or server environment. Once inside, the actor can copy tables that store account credentials and contact details. Passwords are sometimes stored in hashed form, yet older hashing methods can still be processed offline if the attacker also obtains the salt values. The subsequent distribution of the data set through third-party sites is a common pattern after the initial extraction.

Zynga and its sector

Zynga develops and operates online games, including Words with Friends. Companies in this sector maintain accounts for millions of players and therefore collect the identifiers needed for login, account recovery, and in-game communication. A breach at one such firm can expose data that players have reused across other services, extending the practical impact beyond the original game platform.

What data was at risk

The records supplied to breach-tracking services list four categories of information. Public reporting does not confirm whether additional fields were present in the original data set.

• Email addresses
• Usernames
• Phone numbers
• Passwords stored as salted SHA-1 hashes

Why it matters

Email addresses combined with usernames can facilitate targeted phishing campaigns that appear to originate from the gaming service. Phone numbers increase the chance of unsolicited messages or calls. Although the passwords were hashed, the use of SHA-1 means that any offline cracking effort faces fewer technical barriers than with stronger, modern algorithms. For the organization, the incident adds to the record of third-party disclosures that users and regulators may review when assessing data-handling practices.

If your data was in this breach

Change the password on any Zynga account and on any other service where the same password was used. Enable two-factor authentication where available and review recent login activity for signs of unauthorized access. Readers can run a free exposure scan of their email address against known breach data sets to determine whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.