Loading story…
Zynga suffered a major breach that exposed data from about 173 million user accounts, including players of Words With Friends. The compromised information included email addresses, usernames, and passwords stored as salted SHA-1 hashes; some records also contained Facebook IDs and phone numbers. Have I Been Pwned added the incident to its breach corpus after receiving the data from dehashed.com, listing 172,869,660 unique accounts tied to the intrusion.
Reports linked the attack to the actor known as Gnosticplayers, who was also said to have accessed additional Zynga databases beyond the main trove. Those claims included a smaller OMGPop database containing roughly 7 million plaintext passwords tied to the discontinued game. The incident became one of the largest gaming-related credential exposures on record and underscored the ongoing risk that hashed or legacy password stores can still be abused in large-scale account compromise efforts.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Have I Been Pwned listed the Zynga breach as affecting about 173 million unique email addresses, with exposed usernames and salted SHA-1 password hashes. The data was later provided to HIBP by dehashed.com.
On 2019-10-01, reporting indicated that the Zynga breach exposed data belonging to more than 200 million players, primarily tied to Words With Friends. This clarified and escalated the scale of the incident beyond Zynga's initial September disclosure.
Around the same period, the actor using the alias Gnosticplayers claimed to have stolen additional smaller Zynga databases, including data from the discontinued OMGPop service with about 7 million plaintext passwords. This expanded the apparent scope of the incident beyond the initially discussed game data.
In September 2019, Zynga disclosed that it had suffered a data breach affecting user accounts, including players of Words With Friends. The company initially acknowledged the hack without publicly stating its full scale.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
haveibeenpwned.com
Open sourcetheguardian.com
Open sourcecpomagazine.com
Open sourcecbsnews.com
Open sourcecnet.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Flash Flash Revolution, a music-based rhythm game, suffered two major account compromises that together exposed data from roughly **3.7 million** records. In the February 2016 incident, attackers breached the site's **vBulletin forum** and exposed about **1.8 million accounts**, including email addresses, IP addresses, and **salted MD5 password hashes**. A separate breach in July 2019 affected nearly **1.9 million members** and was disclosed as distinct from the earlier compromise. The later incident exposed email addresses, IP addresses, usernames, dates of birth, and **salted MD5 password hashes**, extending the scope of personal data tied to the platform and creating renewed credential and privacy risks for affected users.
Jun 29, 2026
A 15.5 GB dataset allegedly sourced from Chess.com was posted for free on an underground forum, containing 7.3 million records and approximately 4.6–4.7 million unique email addresses. The records include usernames, names, countries, and Chess.com account-related information. Have I Been Pwned added the data to its breach corpus but assessed that it was likely collected by scraping publicly accessible Chess.com web or API data rather than by compromising protected Chess.com systems. About 99% of the email addresses had appeared in earlier breach datasets; nevertheless, the combined account details can enable convincing chess-themed phishing, impersonation, and fraud.
Sep 16, 2026
Club Penguin Rewritten, an independent recreation of Disney's Club Penguin, suffered two major data breaches that exposed account data from its user base. The first incident, in January 2018, affected nearly **1.7 million** unique email addresses, along with usernames, IP addresses, and passwords stored as `bcrypt` hashes; the site said at the time that it was aware of the breach and had contacted affected users. A second breach in July 2019 exposed another **4 million** unique email addresses and included the same categories of data: email addresses, usernames, IP addresses, and `bcrypt`-hashed passwords. Combined, the incidents left roughly **5.7 million** accounts exposed across the two compromises, underscoring repeated security failures at a gaming platform aimed at children and young users.
Jun 29, 2026