Zynga Breach Exposes 172.9 M User Accounts and Password Hashes
What Happened – In September 2019 Zynga, the developer behind Words with Friends, suffered a data breach that released 172,869,660 user records. The leak included email addresses, usernames, phone numbers and passwords stored as salted SHA‑1 hashes. The compromised data were later published on Have I Been Pwned via dehashed.com.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential protection and the need for continuous monitoring of password‑storage controls.
- Highlights the importance of maintaining defensible evidence that hashing algorithms meet current security standards.
- Aligns with the control objective of Identity & Access Management—a single control that satisfies multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected – Gaming and interactive entertainment companies; any organization that stores user credentials for online services.
Recommended Actions
- Review and upgrade password‑hashing algorithms (e.g., migrate from SHA‑1 to bcrypt, Argon2, or PBKDF2).
- Implement continuous credential‑storage monitoring and evidence collection for audit readiness.
- Conduct a gap analysis against the IAM control objective and document remediation steps in your Trust Center.
Technical Notes – The breach exposed salted SHA‑1 password hashes, a legacy algorithm considered weak against modern cracking techniques. No specific CVE was disclosed; the attack vector remains unknown. Source: HIBP breach report