OMGPOP 2013 Data Breach
ObscureIQ Breach Intelligence
Low SeverityWebsite / service breach
OMGPOP Social Gaming Platform Breach (2013): 7.1 Million User Accounts Including Passwords Exposed
social gaming platform; later acquired by Zynga
Verified by ObscureIQ Intelligence
8/100Breach Risk Index
3Data Value
10Market Recency
961dSince Breach
Breach Intelligence Summary
Entity: OMGPOP · Actor: Gnosticplayers (distributor of 2019 leak) · Sources: 7 references
Attack: Unknown
Profile: Platform · Social gaming and casual multiplayer entertainment · Social gaming platform · Global
Timeline: Breach (2013-01-01) · Indexed (Nov 20, 2023) · Year (2013)
Exposure: 7.1M records · 2 fields: Email Address, Password
Status: Confirmed
Executive Summary
In approximately 2013, OMGPOP (omgpop.com), the maker of Draw Something (formerly iminlikewithyou, later acquired by Zynga), suffered a data breach exposing over 7.1 million email addresses and plaintext passwords. The data surfaced publicly in 2019 as part of the hacker "Gnosticplayers" claim of ~218 million accounts across Zynga's game portfolio. Plaintext passwords make the credentials immediately usable for credential stuffing, and they continue to circulate in combolists.
ObscureIQ assessment: Risk is moderate and follows the usual pattern for social gaming breaches: credential compromise, phishing, impersonation, and account takeover. Because the platform was socially connected, there may also be some added exposure around user relationships and persistent gaming identities.
Breach Impact
Because passwords were stored in plaintext, the exposure of ~7.1 million email/password pairs enables immediate credential-stuffing and account-takeover where users reused those passwords, plus targeted phishing. Old credentials continue to circulate in combolists.
About OMGPOP
OMGPOP (omgpop.com) was a social/casual gaming company best known for the hit game Draw Something. Formerly "iminlikewithyou" (iilwy), it was acquired by Zynga in 2012.
Why They Hold Your Data
Social gaming platform built around casual multiplayer play, account-based participation, and socially connected entertainment. The likely data context includes user credentials, profile information, friend or social graph elements, and gameplay-linked account records.
Recent Developments
A ~2013-era OMGPOP dataset surfaced in 2019 when the hacker "Gnosticplayers" claimed access to ~218 million accounts across Zynga's portfolio. The OMGPOP portion (~7.1 million) contained email addresses and plaintext passwords. OMGPOP/Draw Something has since been largely wound down.
Data Points Exposed
2 verified field types
Email Address
Password Critical
Field names are shown in full for clarity and search visibility. Canonical machine keys are emitted only in this page’s structured data.
Exploitation & Downstream Threats
Threat Activity:High
Primary downstream threats:
- Immediate credential stuffing and account takeover (plaintext passwords)
- Targeted phishing using exposed emails
- Ongoing exposure via combolist circulation
Threat vectors:
- Credential stuffing & account takeover
- Password reuse exploitation
- Phishing & social engineering
Threat Actor: Gnosticplayers (distributor of 2019 leak)
Gnosticplayers (distributor of 2019 leak)
Unknown
Attribution and method are based on available breach intelligence. Reported attack vector: Unknown.
Recommended Actions
If you believe your information may be included:
Change Reused Passwords
Update this account and anywhere you reused the password; use a manager.
Enable MFA Everywhere
Turn on multi-factor authentication on email first, then financial accounts.
Report & Recover
If you spot misuse, start an official recovery plan and report fraud.
Frequently Asked Questions
What happened in the OMGPOP breach?▾
In approximately 2013, OMGPOP (omgpop.com), the maker of Draw Something (formerly iminlikewithyou, later acquired by Zynga), suffered a data breach exposing over 7.1 million email addresses and plaintext passwords. The data surfaced publicly in 2019 as part of the hacker "Gnosticplayers" claim of…
What data was exposed?▾
Verified fields include Email Address, Password.
What should I do if I was affected?▾
Change reused passwords, enable MFA, and (if identity or financial data is involved) freeze your credit and monitor your accounts.
Sources & References
Every claim on this page is traceable. This breach draws on:
Breach Index
Cross-source
9ghz
Cross-source
BreachNet.pw
Cross-source
LeakCheck.io
Cross-source
LeakCheck.net
Cross-source
leakfind
ObscureIQ Intelligence
ObscureIQ proprietary analysis
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation