Zynga Data Breach: 173 Million Accounts, No Settlement
Case Dismissed
The Zynga data breach of September 2019 hit Words With Friends and Draw Something players — about 173 million accounts, with email addresses, usernames, hashed passwords and some phone numbers. The Zynga class action lawsuit that followed was dismissed with prejudice on April 29, 2022. There is no settlement, no fund and no claim form. What still helps is changing any password you reused.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by any company named on this page, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened in the Words With Friends Data Breach
Words With Friends is a Scrabble-style game: you play words from a rack of seven letters onto a shared board (if you want to see which words a rack of letters makes, a solver shows every option). Draw Something is a Zynga drawing-and-guessing game.
On September 12, 2019, Zynga posted a “Player Security Announcement” saying that account login information for certain players of Draw Something and Words With Friends may have been accessed by outside hackers, and that it did not believe any financial information was taken. Zynga later told investors that hackers accessed player account information during the third quarter of 2019.
The breach-tracking service Have I Been Pwned lists 172,869,660 Zynga accounts: email addresses, usernames, phone numbers and passwords stored as salted SHA-1 hashes. A hacker claimed more than 218 million users; that is the attacker’s claim, cited in the complaint, not a verified count.
The lawsuits alleged that Zynga failed to safeguard names, email addresses and passwords, used outdated password hashing, and gave inadequate notice. One named plaintiff alleged that a Draw Something password had been stored in plain text.
Case details
Five consumer class actions were filed in federal court starting in March 2020. One, filed in Maryland, was transferred to California; the rest were consolidated as I.C. v. Zynga, Inc., No. 4:20-cv-01539-YGR, in the U.S. District Court for the Northern District of California before Judge Yvonne Gonzalez Rogers.
After a hearing on July 27, 2021, the court sent three named plaintiffs to individual arbitration under Zynga’s terms of service, and dismissed the remaining claims for lack of standing with leave to amend. Plaintiffs refiled on August 27, 2021.
On April 29, 2022 the court dismissed the second amended complaint without leave to amend. It held that the plaintiffs had not alleged a concrete injury and so lacked constitutional standing, noting that the stolen data did not include items such as Social Security numbers. The case was dismissed with prejudice and closed.
Status: Dismissed in 2022, No Settlement
Zynga has been part of Take-Two Interactive since May 2022. Other Zynga cases now in court are about different issues: in Manhattan federal court, Dougherty v. Zynga Inc., No. 1:26-cv-02772, alleges that Toon Blast and Toy Blast shared players’ data in violation of the Video Privacy Protection Act; the court entered a memorandum and opinion on October 13, 2026. None of these cases concern the 2019 breach.
Was Your Account in the Breach?
If you had a Words With Friends or Draw Something account before September 2019, assume your email address, username and hashed password may have been exposed. The quickest check is to enter your email address at Have I Been Pwned, which lists the Zynga breach.
Being in the breach does not entitle you to money. The class action ended without paying anyone. Three named plaintiffs were sent to arbitration; Zynga’s terms of service generally require players to bring claims that way.
Is There Any Money?
A different Zynga case did pay: Ferrando v. Zynga, No. 2:22-cv-00214 in the Western District of Washington, over social casino games, settled for $12.0 million. That was for Washington players who spent money in those games, not for breach victims, and its claim deadline was November 1, 2022. For what breach settlements that did resolve have paid, see the data breach settlement calculator.
How cases like this one end
Our copy of the federal courts’ own case database covers 118,291 other personal injury casesclosed in U.S. federal district courts between 2015 and 2026, 3.9% of them filed as class actions:
- 39.6% ended in a settlement recorded by the court. Another 14% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 39.6% and 53.6%.
- 5.7% were decided on a motion before any trial.
- 1 in 109 reached a trial (0.9%), after a median of 23.9 months.
- Median time from filing to the end of the case: 9 months.
- Only 802 of them (0.7%) record a money award at all; the median of those is $537,500.
These are base rates for this type of case (federal other personal injury cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Zynga Data Breach Timeline
September 12, 2019 — Zynga Discloses the Breach
Zynga says login information for some Draw Something and Words With Friends players may have been accessed, and that no financial information was taken.
December 2019 — The Scale Becomes Public
Have I Been Pwned adds 172,869,660 Zynga accounts: emails, usernames, phone numbers and salted SHA-1 password hashes.
March 2020 — First Zynga Class Action
The first of five federal class actions is filed. They are consolidated in the Northern District of California as I.C. v. Zynga, No. 4:20-cv-01539.
July 27, 2021 — Arbitration and First Dismissal
Judge Yvonne Gonzalez Rogers sends three plaintiffs to arbitration and dismisses the rest for lack of standing, with leave to amend.
April 29, 2022 — Dismissed With Prejudice
The court dismisses the amended complaint without leave to amend and closes the case. No class was certified and nothing was paid.
As of October 2026 — Nothing to Claim
No settlement, fund, claim form or deadline exists for the 2019 breach. Zynga has been a Take-Two company since May 2022.
Three Things to Watch For
A breach of about 173 million email addresses with no settlement leaves plenty of room for fakes:
“Claim your Zynga data breach settlement”
There is no Zynga data breach settlement, so there is no claim site and no administrator. A page or email asking for your Social Security number or bank details to “release your payment” is collecting data, not filing a claim.
Fake Words With Friends account warnings
The leaked data pairs your email address with your game username, so a phishing email can greet you by your Words With Friends name and ask you to “verify” your password. Go to the app directly instead of clicking links.
Mix-ups with the $12.0 million casino settlement
Messages may cite the real Ferrando social casino settlement to sound credible. That deal was for Washington players of Zynga slot games, its claim deadline was November 1, 2022, and it has nothing to do with the breach.
Zynga Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
How do I check if I got data breached in the Zynga hack?
Enter your email address at Have I Been Pwned, which lists the Zynga breach of September 2019 and 172,869,660 affected accounts. If you had a Words With Friends or Draw Something account before then, assume you are in it.
What data was stolen in the Words With Friends data breach?
Email addresses, usernames, passwords stored as salted SHA-1 hashes and phone numbers, per Have I Been Pwned. Plaintiffs also alleged dates of birth, password reset tokens, Facebook names and one plain-text Draw Something password for some players. Zynga said no financial information was accessed.
Is there a Zynga class action settlement I can claim?
No. The Zynga class action lawsuit over the breach was dismissed with prejudice on April 29, 2022. As of October 2026 there is no settlement, no fund, no claim form and no deadline.
Why was the Zynga lawsuit dismissed?
Judge Yvonne Gonzalez Rogers held that the plaintiffs had not shown a concrete injury, so they lacked standing to sue in federal court. Three named plaintiffs had already been sent to arbitration under Zynga’s terms of service.
How much compensation do you get for a data breach?
It depends on the settlement. For the Zynga breach the answer is nothing, because the case was dismissed. Breach settlements that do resolve usually pay documented losses plus a small flat amount; the data breach settlement calculator shows typical figures.
Is the new Zynga lawsuit about Toon Blast the same case?
No. Dougherty v. Zynga Inc., No. 1:26-cv-02772 in the Southern District of New York, alleges that Toon Blast and Toy Blast shared players’ data in violation of the Video Privacy Protection Act. A California judge transferred it there on March 31, 2026. It has nothing to do with the 2019 breach.
Where is Zynga Inc. located?
Zynga’s last annual report listed its headquarters at 699 Eighth Street, San Francisco, California. Since May 2022 Zynga has been owned by Take-Two Interactive.
What should I do now?
Change any password you reused from your Zynga account, because hashed passwords can be cracked and tried on other sites. Turn on two-factor authentication for email and banking. A credit freeze is free, but the Zynga data did not include Social Security numbers, so password hygiene matters more here.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorWhat resolved breach cases have actually paid per person
- Open Class Action SettlementsSettlements you can still file a claim in, with deadlines
- Settlement Payout CalculatorEstimate a per-person share from fund size and claim rates
- AT&T Data Breach SettlementA breach case that did produce a settlement fund