Zynga Data Breach (2019)

Zynga went first. According to CNET, the games company confirmed on 12 September 2019 that account login details for Draw Something and Words with Friends players had been accessed, said law enforcement had been told, and described an investigation that was still open. On its support page Zynga added that it had moved to block invalid logins and that some players would have to choose a new password.

What it did not give was a number. That came from the other side: CNET reported on 1 October 2019 that a hacker had claimed the Zynga breach, citing a report by The Hacker News. According to the claim, the data covered more than 218 million Words with Friends accounts, covering Android and iOS players who installed the game before early September.

Have I Been Pwned loaded the set in December 2019 and counts 172,869,660 unique email addresses. Its figure sits below the claimed account total because it counts each address once, however many games or accounts used it.

Four fields make up the Zynga record: email addresses, usernames, phone numbers and password hashes. No payment details appear in the record, which is the part most players worry about first.

The phone number is the field to think about. It turns this record into a way to reach you by text, and a message that mentions your username and the game reads as genuine. Usernames chosen for a casual game also tend to be reused on forums and other apps, which turns one row of the Zynga data breach into a map of where else to try the same login.

Zynga stored passwords as SHA-1 hashes with a salt, according to Have I Been Pwned. The salt does one useful thing: two players with the same password end up with different hashes, so cracking one does not hand over the other, and lookup tables built in advance are useless.

What the salt cannot fix is speed. SHA-1 was designed to run fast, and a single graphics card tests billions of guesses a second against each salted hash. So an attacker simply works through the most likely passwords one account at a time. Short, common or reused passwords from the Zynga breach should be treated as known; a long random one probably held.

Change the Zynga password on any other site where you used it, and switch on two-factor sign-in for your email first, since that inbox resets everything else. Then be suspicious of texts about your games, prizes or account problems; the phone number in this record is how they would reach you.

If your Zynga username doubles as your handle elsewhere, those accounts deserve their own passwords too. Finally, run the free LeakNix check on the address: one record is rarely the only one.