170m passwords stolen in Zynga hack, monitor says
More than 170m usernames and passwords were stolen from the company behind Words With Friends in a hack this year, according to a breach monitoring site.
Zynga, a social game developer that made its name with Farmville a decade ago and acquired Words With Friends a year later, admitted to the hack in September, telling users that cyber-attacks were “one of the unfortunate realities of doing business today”.
It did not reveal at the time how many accounts were affected. Now it has been revealed that the stolen database contained information on 172,869,660 unique accounts.
According to Have I Been Pwned, a monitoring site that warns internet users if their personal details have been stolen in data breaches, the information accessed by the hacker included email addresses, usernames and passwords stored in securely.
The password security, involving two processes called salting and hashing, means it would be time-consuming and expensive for anyone who gets hold of the stolen data to uncover usable passwords.
The dump also included some Facebook IDs and phone numbers for users who had provided that information to the company.
The Hacker News spoke to the alleged perpetrator, a hacker who goes by the online alias Gnosticplayers, who said they had also stolen other, smaller databases from Zynga, including 7m unprotected passwords for users of a now discontinued game called OMGPop.
“This is just the latest in a string of hacks from Gnosticplayers, who appears to be vying for a reputation as much as monetary gain,” said Max Heinemeyer, the director of threat hunting at the cybersecurity company Darktrace. “Again we are reminded that companies are too often on the back foot and scrambling to do damage control in the aftermath of a data breach.”
Concerned users can check whether their account was among those breached at Have I Been Pwned, which ranks the Zynga breach as the 10th largest it has catalogued and the second largest from a household name, after MySpace’s 2008 breach that exposed 360m accounts. That latter breach was not made public until May 2016.
Zynga told users in September: “We recently discovered that certain player account information may have been illegally accessed by outside hackers. An investigation was immediately commenced, leading third-party forensics firms were retained to assist, and we have contacted law enforcement.”