Love playing Draw Something or Words With Friends? Change your password now

(Image credit: Shutterstock)

A new report from Have I Been Pwned has revealed that a data breach at the online game company Zynga back in September affected 170m users.

To make matters worse, the Zynga hack ranks 10th among Have I Been Pwned's list of its all-time largest hacks of user information.

In September, Zynga admitted that it had suffered a breach that affected two of its most popular games and at that time, the company provided more information on its ongoing investigation into the incident in a player security announcement, saying:

“While the investigation is ongoing, we do not believe any financial information was accessed.  However, we have identified account login information for certain players of Draw Something and Words With Friends that may have been accessed.  As a precaution, we have taken steps to protect these users’ accounts from invalid logins.  We plan to further notify players as the investigation proceeds.”

Zynga data breach

According to Have I Been Pwned, the data breach Zynga suffered exposed 173m unique email addresses along with usernames and passwords stored as salted SHA-1 hashes.

While no financial information was stolen as a result of the incident, the passwords and usernames obtained by the attackers could be used to gain access to their other accounts online, especially if they reused the same passwords for multiple accounts.

CEO of the cybersecurity awareness and cloud data analytics platform CybSafe, Oz Alashe explained what Zynga users should do to protect themselves following the incident, saying:

“The disclosure of the full scale and nature of this breach, some three months after the initial announcement, is concerning. This delay, and the initial lack of information provided by Zynga to its users, has put victims at unnecessary risk. Especially now that the extent of the breach is clear, users who think they may have registered to use one of Zynga’s products, such as Farmville and Words With Friends, should navigate to haveibeenpwned.com to confirm whether they are impacted. Those who discover that their details have been compromised need to promptly act to change their passwords.”

Via The Verge

Anthony Spadafora

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.