Zynga data breach (2019): what happened to Words With Friends players
2 min read · Updated November 8, 2026
In September 2019 Zynga confirmed that a hacker had accessed player account data for its Words With Friends game. Breach-tracking services later counted around 173 million accounts. Emails, usernames, phone numbers and hashed passwords were included. Change reused passwords and check your email.
What happened
Zynga said it had discovered unauthorised access to certain player information and began notifying affected users. A hacker known online for selling stolen databases claimed responsibility and offered the data.
The company reset passwords for accounts it believed were affected and said financial information was not accessed.
What was exposed
- ✓Email addresses and usernames.
- ✓Hashed passwords, stored using a salted SHA-1 method that is weaker than modern standards.
- ✓Phone numbers for some accounts and linked social account IDs.
Were you caught up in a major breach?
Old breaches keep circulating for years. Scan your email against known breach records for a one-time $1.99.
Why it still matters
Hashed passwords from older systems can often be cracked, especially simple ones. Once cracked, they are tried against other sites in credential stuffing attacks.
Casual game accounts are easy to forget, yet they sit in long lists that criminals buy and trade, so old games can still affect you.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
Frequently asked questions
Were payment details exposed?+
Zynga said financial information such as card numbers was not part of the accessed data.
I never played much. Can I still be in it?+
Yes. Even a single old account would be included, so checking your email is worthwhile.
Should I delete the old account?+
If you no longer play, deleting it reduces future exposure. Change the password first if you reused it elsewhere.
Stop guessing. Check your email in seconds.
The Leakill scan looks for your email address in known breach records and delivers a detailed report: the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-time $1.99 payment, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.