Skip to main contentSkip to navigationSkip to navigation
Farmville
Zynga made its name with Farmville a decade ago. Photograph: Stefan Sollfors/Alamy
Zynga made its name with Farmville a decade ago. Photograph: Stefan Sollfors/Alamy

170m passwords stolen in Zynga hack, monitor says

This article is more than 4 years old

Words With Friends company admitted hack in September but size only now revealed

More than 170m usernames and passwords were stolen from the company behind Words With Friends in a hack this year, according to a breach monitoring site.

Zynga, a social game developer that made its name with Farmville a decade ago and acquired Words With Friends a year later, admitted to the hack in September, telling users that cyber-attacks were “one of the unfortunate realities of doing business today”.

It did not reveal at the time how many accounts were affected. Now it has been revealed that the stolen database contained information on 172,869,660 unique accounts.

According to Have I Been Pwned, a monitoring site that warns internet users if their personal details have been stolen in data breaches, the information accessed by the hacker included email addresses, usernames and passwords stored in securely.

The password security, involving two processes called salting and hashing, means it would be time-consuming and expensive for anyone who gets hold of the stolen data to uncover usable passwords.

The dump also included some Facebook IDs and phone numbers for users who had provided that information to the company.

The Hacker News spoke to the alleged perpetrator, a hacker who goes by the online alias Gnosticplayers, who said they had also stolen other, smaller databases from Zynga, including 7m unprotected passwords for users of a now discontinued game called OMGPop.

“This is just the latest in a string of hacks from Gnosticplayers, who appears to be vying for a reputation as much as monetary gain,” said Max Heinemeyer, the director of threat hunting at the cybersecurity company Darktrace. “Again we are reminded that companies are too often on the back foot and scrambling to do damage control in the aftermath of a data breach.”

Concerned users can check whether their account was among those breached at Have I Been Pwned, which ranks the Zynga breach as the 10th largest it has catalogued and the second largest from a household name, after MySpace’s 2008 breach that exposed 360m accounts. That latter breach was not made public until May 2016.

Zynga told users in September: “We recently discovered that certain player account information may have been illegally accessed by outside hackers. An investigation was immediately commenced, leading third-party forensics firms were retained to assist, and we have contacted law enforcement.”

More on this story

More on this story

  • Today in Focus
    How an infamous ransomware gang found itself hacked

  • Huge cybersecurity leak lifts lid on world of China’s hackers for hire

  • ‘Elevated’ risk of hackers targeting UK drinking water, says credit agency

  • British teenager behind GTA 6 hack receives indefinite hospital order

  • Film to tell story of Scottish hacker Gary McKinnon’s fight against US extradition

  • Scottish MP Stewart McDonald fears emails hacked by Russia-linked group

  • Royal Mail ransomware attackers threaten to publish stolen data

  • Ministers creating ‘wild west’ conditions with use of personal phones

  • ‘Robust protocols’ in place, says Gove amid reports of Liz Truss phone hack

  • Mobiles are inherently insecure, which might be a surprise to British politicians

Most viewed

Most viewed