Zynga 2019 Data Breach
Company · Mobile and social game development · Game publisher · Global
Zynga Mobile Game Developer Breach (2019): 172 Million Words with Friends & FarmVille Player Accounts Exposed
Video game developer.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
12/100
Lower riskHigher risk
Lower: limited current risk based on data value and recency.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
172.9MRecords
2019Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Breach Summary
Zynga, the mobile game publisher behind Words With Friends and FarmVille, suffered a breach in September 2019 when a hacker known as GnosticPlayers gained unauthorized access to one of its player databases. The attacker claimed to have downloaded records for every Android and iOS user who had installed Words With Friends before September 2, 2019. While Zynga's own public statement acknowledged the breach, independent estimates put the exposed record count at approximately 172.9 million unique accounts. The attack is believed to have involved social engineering, though Zynga has never released a detailed forensic account. The stolen data included email addresses, usernames, login IDs, and passwords stored as salted SHA-1 hashes, a format that is weaker than modern encryption standards and can be cracked with enough computing effort. Many records also contained phone numbers, password-reset tokens, Facebook IDs, and Zynga account numbers. No financial or payment data was stored on the compromised server, so credit card information was not exposed. Even so, the combination of email addresses and crackable passwords gives attackers the core ingredients for phishing campaigns, credential stuffing, and account takeover attempts, particularly against users who reuse the same password across multiple services. Zynga notified affected players and prompted password resets following the disclosure. No major regulatory action was publicly reported in the aftermath. For anyone who played Words With Friends or other Zynga titles before September 2019, the practical risk is that their login credentials may have circulated in criminal markets for years. Changing passwords on any account that shared credentials with a Zynga login remains the most important step affected users can take.
Full threat analysis, exploitation vectors, and principal guidance below.
12 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
172.9M records analyzed
About Zynga
Zynga is a major mobile and social game publisher best known for titles such as Words With Friends, Zynga Poker, and FarmVille. It now operates as a wholly owned publishing label of Take-Two Interactive, with a business centered on free-to-play mobile games, live operations, and long-tail player engagement across a portfolio of casual and midcore titles.
Why They Hold Your Data
Gaming platforms collect user accounts, emails, passwords, and in-game activity data, often tied to social features.
Recent Developments
Zynga remains an active part of Take-Two’s mobile strategy and continues to run large live-service franchises and brand partnerships across its game portfolio. Recent public announcements in 2025 and 2026 highlight major updates to Top Eleven and a cross-title CBS Survivor collaboration, showing that the label is still being used to launch seasonal content, partnerships, and live-ops expansions across multiple games.
Data Points Exposed
4 verified field types
Email Address
Password High
Phone Number
Username
Breach Impact
The 2019 Zynga breach was significant because it affected a massive consumer gaming user base and exposed data that could be reused beyond the games themselves. Public breach tracking says the incident exposed about 173 million unique email addresses along with usernames and salted SHA-1 password hashes, creating a large credential set useful for password cracking, credential stuffing, phishing, and account takeover attempts across other services where users reused login information.
Exploitation & Downstream Threats
• Credential stuffing against reused passwords across other platforms | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses
Principal Risk Advisory
What this means for a principal
A consumer-service breach: contact and account data supports phishing, account takeover and profile enrichment. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Reset any reused passwords and enable MFA on email first, then financial accounts.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
G
Threat Actor: GnosticPlayersConfidence: Medium
Motivation: Financial
A prolific breach seller persona active around 2019 and associated with large batches of stolen account databases. Some modern reporting groups GnosticPlayers with the broader ShinyHunters data-theft ecosystem, but that relationship should be handled cautiously.
This breach is linked to the GnosticPlayers batches (2019) campaign (2019 related breaches tracked by ObscureIQ). See the full campaign analysis →
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation