Zynga Breach

In September 2019, casual-gaming giant Zynga Inc.—maker of the wildly popular mobile title Words With Friends—revealed that one of its player databases had been raided by a hacker who goes by “GnosticPlayers.” Zynga’s public statement on 12 September 2019 acknowledged “unauthorized access” to certain player accounts; the attacker promptly told reporters he had downloaded the details of every Android and iOS user who installed the game before 2 September 2019, a cache estimated at ≈218 million records.   

Data exposed  

The stolen trove contained the core ingredients of an online identity: e-mail addresses, usernames, login IDs and salted SHA-1 password hashes. For many players it also included password-reset tokens, Facebook IDs, Zynga account numbers, phone numbers and, in some cases, full names. Zynga stressed that no financial data was stored on the compromised server, so payment information was not affected, but the breached credentials alone were enough to fuel phishing and credential-stuffing attacks.  
  

Attack vector  

Zynga has never published a forensic deep-dive. Independent researchers believe the perpetrator exploited a web-application flaw to gain remote code execution, then pivoted into the account database. The same hacker had previously advertised dumps from Canva and Evite, suggesting a pattern of hunting unpatched vulnerabilities, exfiltrating user tables and selling them on dark-web markets once press coverage drove up their price.   
  

Company response  

After detecting the intrusion, Zynga invalidated password-reset tokens, forced login refreshes for legacy users, engaged an external incident-response firm and notified federal law-enforcement agencies. It began e-mail and in-app notifications, though critics argued the statements were vague about scale.   
  

Fallout  

Coverage by outlets such as Forbes and The Verge placed the breach among the ten largest credential leaks ever recorded. Early in 2020 Zynga faced class-action lawsuits alleging negligence and violations of California privacy statutes, citing its reliance on the weakened SHA-1 algorithm and the absence of multi-factor authentication. Zynga ultimately agreed to fund credit-monitoring services and undergo third-party security audits, though settlement sums were modest compared with the brand damage sustained.