Breach Disclosure: Zynga

In September 2019, game developer Zynga suffered a data breach. A report from HackerNews claims that data breach villain gnosticplayers was responsible for the breach. 218 million rows were downloaded, with the following column data: names, emails, logins, SHA1 hashed and salted passwords, password reset tokens, phone numbers, Facebook IDs and Zynga account IDs.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

According to a September 12, 2019 post by Zynga, no financial data was accessed. The company engaged leading third-party forensics firms and are working with law enforcement. Players of two of Zynga's games, Draw Something and Words with Friends, were included in the breach.