According to a new report from Have I Been Pwned, 170M emails along with usernames and hashed passwords were stolen in the Zynga breach in September
In September 2019, game developer Zynga … Manikanta Immanni / TechDator : Zynga Data Breach Has Comprised Over 172 Million Accounts Jackie Dunham / CTVNews : 173 million accounts exposed in hack of ‘Words with Friends’ developer Cody DeBos / The Burn-In : Massive Zynga hack compromises 170 million player accounts Christopher Baugh / iPhone in Canada Blog : ‘Words With Friends’ Developer Zynga Hack Exposes Over 170 Million User Accounts Tweets: @norton : More than 170m usernames and passwords are believed to have been stolen from the company behind Words With Friends in a hack this year. Now it has been revealed that the stolen database contained information on 172,869,660 unique accounts. https://www.theguardian.com/ ... @percona : A September password breach of online game company Zynga affected 170 million people, according to a new report from Have I Been Pwned. According to that site, the Zynga hack ranks 10th among its all-time largest hacks of user information. https://www.theverge.com/... by @verge
Context & Ripple Effects
This closes the loop on a breach whose size had been open since early October, when a hacker first claimed to have hit Words With Friends and Zynga began notifying users without disclosing scale (the initial claim). Have I Been Pwned's ingestion turns that unverified claim into a measurable record: roughly 170 million emails, usernames, and hashed passwords now queryable by victims.
The timing matters because the fallout was already underway — two plaintiffs had filed a 'failure to reasonably safeguard' suit against Zynga citing ~172 million affected users (the March 2020 lawsuit) — and because this follows a familiar lineage of mega-scale social-gaming credential dumps like the LinkedIn/Myspace troves.
First-order effects
- Words With Friends players can now check whether their credentials were in the dump and rotate passwords that were reused elsewhere, while Zynga's legal exposure sharpens: plaintiffs arguing inadequate safeguards now have an independently confirmed figure behind the claim.
Second-order effects
- Hashed is not safe — if the hashing was weak, cracking converts the dump into working logins for credential-stuffing attacks on other services, the same recycling pattern seen when the Myspace database surfaced years after the original hack (Myspace's 360M claimed emails).
Third-order effects
- Breached gaming credentials keep re-entering circulation long after the incident: the later Naz.API dataset added tens of millions of stale addresses to Have I Been Pwned (the 2024 Naz.API ingestion), meaning a single 2019 breach feeds phishing and stuffing pipelines for years — a structural argument for regulators treating notification as the start of remediation, not its end.
The trend: Consumer-platform breaches are becoming permanent inventory in criminal credential markets, with aggregators like Have I Been Pwned converting years-old hacks into actionable victim notifications.