A new report from Have I Been Pwned has revealed that a data breach at the online game company Zynga back in September affected 170m users.To make matters worse, the Zynga hack ranks 10th among Have I Been Pwned's list of its all-time largest hacks of user information.In September, Zynga admitted that it had suffered a breach that affected two of its most popular games and at that time, the company provided more information on its ongoing investigation into the incident in a player security announcement, saying:While the investigation is ongoing, we do not believe any financial information was accessed.
However, we have identified account login information for certain players of Draw Something and Words With Friends that may have been accessed.
As a precaution, we have taken steps to protect these users accounts from invalid logins.
We plan to further notify players as the investigation proceeds.According to Have I Been Pwned, the data breach Zynga suffered exposed 173m unique email addresses along with usernames and passwords stored as salted SHA-1 hashes.While no financial information was stolen as a result of the incident, the passwords and usernames obtained by the attackers could be used to gain access to their other accounts online, especially if they reused the same passwords for multiple accounts.CEO of the cybersecurity awareness and cloud data analytics platform CybSafe, Oz Alashe explained what Zynga users should do to protect themselves following the incident, saying:The disclosure of the full scale and nature of this breach, some three months after the initial announcement, is concerning.
This delay, and the initiallack of informationprovided by Zynga to its users, has put victims at unnecessary risk.
Especially now that the extent of the breach is clear, users who think they may have registered to use one of Zyngas products, such as Farmville and Words With Friends, should navigate tohaveibeenpwned.comto confirm whether they are impacted.
Those who discover that their details have been compromised need to promptly act to change their passwords.Via The Verge