170m passwords stolen in Zynga hack, monitor says – The Guardian, Theguardian.com

.

*********************

**************************** () ******************************** (**************************************** (**********************************************************Zynga made its name with Farmville a decade ago. Photograph: Stefan Sollfors / Alamy (******************************************

Have I Been Pwned, a monitoring site that warns internet users if their personal details have been stolen in data breaches, the information accessed by the hacker included email addresses, usernames and passwords stored in securely.

The password security, involving two processes called salting and hashing, means it would be time-consuming and expensive for anyone who gets hold of the stolen data to uncover usable passwords.

The dump also included some Facebook IDs and phone numbers for users who had provided that information to the company.

The Hacker Newsspoke to the alleged perpetrator, a hacker who goes by the online alias Gnosticplayers, who said they had also stolen other, smaller databases from Zynga, including 7m unprotected passwords for users of a now discontinued game called OMGPop.

“This is just the latest in a string of hacks from Gnosticplayers, who appears to be vying for a reputation as much as monetary gain,” said Max Heinemeyer, the director of threat hunting at the cybersecurity company Darktrace . “Again we are reminded that companies are too often on the back foot and scrambling to do damage control in the aftermath of a data breach.”

Concerned users can check whether their account was among those breached at Have I Been Pwned, which ranks the Zynga breach as the************************************************************************************ th largest it has cataloged and the second largest from a household name, after MySpace’s breach that exposed m accounts. That latter breach was not made public until May 3165.

Zynga told users in September: “We recently discovered that certain player account information may have been illegally accessed by outside hackers. An investigation was immediately commenced, leading third-party forensics firms were retained to assist, and we have contacted law enforcement. ”