Zynga — 173 Million Words With Friends Accounts (2019)

What happened

In September 2019 the game developer Zynga — best known for Words With Friends and FarmVille — suffered a breach exposing 172,869,660 unique email addresses alongside usernames, phone numbers and passwords stored as salted SHA-1 hashes. The data was provided to Have I Been Pwned by dehashed.com. Reporting at the time carried a considerably larger claim from the seller; the 173 million figure is the count of unique addresses actually verified in the data.

Salted SHA-1 is better than MySpace and still not good

Zynga salted its hashes, which is the difference between this breach and the MySpace one. A salt means every account gets a unique hash even when two people chose the same password, so an attacker cannot crack the whole set at once. That genuinely helps.

What a salt does not fix is speed. SHA-1 is designed to be fast, which is a virtue in a checksum and a liability in a password hash — modern hardware tries enormous numbers of candidates per second against a single salted hash. The result is predictable: weak and moderate passwords fall, strong ones mostly hold. If your Zynga password was a common word with a number after it, treat it as recovered. If it was long and random, it probably survived.

This is why blanket advice fails. The same sentence — "passwords were exposed" — describes MySpace, where nothing survived, and Wattpad, where essentially everything did.

Why the phone numbers are the surprise

Casual games do not usually hold phone numbers. Zynga's did, and that single field changes the character of the breach: an email address plus a phone number plus a username is enough to pivot into SIM-swap and account-recovery attacks against services far more valuable than a word game.

There is a demographic point here that generic coverage misses. Words With Friends has an unusually old and unusually family-connected player base — it is the game people play with their parents and grandparents. A breach of a shooter exposes gamers; a breach of Words With Friends exposes the least security-hardened members of a family, using an email address they have had for twenty years and a password they use everywhere.

The identity-chain implication

Gaming handles are one of the most reliable joins in the whole identity graph, because people keep them. A username chosen for a Zynga account in 2012 very often still appears on Steam, Discord and Reddit, and each of those carries different fragments of the same person.

Here the join is unusually rich: the dataset supplies handle, email address and phone number in one row, so it collapses three separate discovery steps into one lookup.

What to do now