Zynga Data Breach Analysis
Tags: security, webdev, datascience, news
Published: 2022-11-12 06:30:00

<!-- wp:heading -->
<h2>Introduction</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Zynga is an American social game developer. The company was founded in April 2007 with headquarters in San Francisco, California, United States. The company has a mission to "connect the world through video games".</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The company has developed multiple well-known games including Farmville, Zynga Poker, Words With Friends, Mafia Wars and Empires &amp; Allies amongst others.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Zynga acknowledged the breach in September 2019 - in total, the data breach contains 206,267,210 records including duplicates and 150,363,954 records without duplicates.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>What data is at risk?</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>The leaked data includes usernames, email addresses, dates of some sort (presumably registration and last visit dates), phone numbers and passwords hashed with the SHA-1 algorithm.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Email addresses</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>50 of the most frequently used email domains on Zynga can be seen below:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>#</th><th>Email Domain</th><th>Frequency</th></tr><tr><td>1</td><td>gmail.com</td><td>57,066,237</td></tr><tr><td>2</td><td>yahoo.com</td><td>31,705,551</td></tr><tr><td>3</td><td>hotmail.com</td><td>19,621,241</td></tr><tr><td>4</td><td>aol.com</td><td>6,208,662</td></tr><tr><td>5</td><td>zyngawf.com</td><td>3,385,626</td></tr><tr><td>6</td><td>comcast.net</td><td>2,007,109</td></tr><tr><td>7</td><td>hotmail.co.uk</td><td>1,833,752</td></tr><tr><td>8</td><td>icloud.com</td><td>1,742,705</td></tr><tr><td>9</td><td>live.com</td><td>1,646,972</td></tr><tr><td>10</td><td>msn.com</td><td>1,229,160</td></tr><tr><td>11</td><td>ymail.com</td><td>1,033,850</td></tr><tr><td>12</td><td>outlook.com</td><td>996,471</td></tr><tr><td>13</td><td>sbcglobal.net</td><td>943,419</td></tr><tr><td>14</td><td>me.com</td><td>805,438</td></tr><tr><td>15</td><td>att.net</td><td>708,214</td></tr><tr><td>16</td><td>verizon.net</td><td>665,298</td></tr><tr><td>17</td><td>aim.com</td><td>648,613</td></tr><tr><td>18</td><td>yahoo.co.uk</td><td>620,792</td></tr><tr><td>19</td><td>hotmail.fr</td><td>547,208</td></tr><tr><td>20</td><td>qq.com</td><td>500,120</td></tr><tr><td>21</td><td>cox.net</td><td>471,127</td></tr><tr><td>22</td><td>googlemail.com</td><td>426,282</td></tr><tr><td>23</td><td>rocketmail.com</td><td>409,631</td></tr><tr><td>24</td><td>bellsouth.net</td><td>398,100</td></tr><tr><td>25</td><td>live.co.uk</td><td>343,250</td></tr><tr><td>26</td><td>gmail.con</td><td>327,016</td></tr><tr><td>27</td><td>btinternet.com</td><td>298,615</td></tr><tr><td>28</td><td>bigpond.com</td><td>279,067</td></tr><tr><td>29</td><td>zynga.com</td><td>264,152</td></tr><tr><td>30</td><td>charter.net</td><td>241,341</td></tr><tr><td>31</td><td>yahoo.con</td><td>220,323</td></tr><tr><td>32</td><td>mail.com</td><td>213,373</td></tr><tr><td>33</td><td>web.de</td><td>212,789</td></tr><tr><td>34</td><td>mac.com</td><td>204,985</td></tr><tr><td>35</td><td>optonline.net</td><td>199,181</td></tr><tr><td>36</td><td>mail.ru</td><td>188,894</td></tr><tr><td>37</td><td>yahoo.com.au</td><td>187,014</td></tr><tr><td>38</td><td>live.com.au</td><td>180,759</td></tr><tr><td>39</td><td>hotmail.it</td><td>169,146</td></tr><tr><td>40</td><td>gmx.de</td><td>162,993</td></tr><tr><td>41</td><td>yahoo.ca</td><td>162,234</td></tr><tr><td>42</td><td>yahoo.fr</td><td>162,115</td></tr><tr><td>43</td><td>sky.com</td><td>157,304</td></tr><tr><td>44</td><td>Gmail.com</td><td>147,545</td></tr><tr><td>45</td><td>naver.com</td><td>141,011</td></tr><tr><td>46</td><td>live.fr</td><td>125,987</td></tr><tr><td>47</td><td>earthlink.net</td><td>122,485</td></tr><tr><td>48</td><td>163.com</td><td>118,299</td></tr><tr><td>49</td><td>libero.it</td><td>115,875</td></tr><tr><td>50</td><td>orange.fr</td><td>114,819</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>From the list above we can make assumptions about the locations of Zynga users:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><td><strong>#</strong></td><td><strong>Domain Purpose / Country</strong></td><td><strong>User count</strong></td></tr><tr><td>1</td><td>Commercial / United States</td><td>129,250,910</td></tr><tr><td>2</td><td>Network Infrastructure</td><td>5,756,274</td></tr><tr><td>3</td><td>Great Britain</td><td>2,797,794</td></tr><tr><td>4</td><td>France</td><td>950,129</td></tr><tr><td>5</td><td>Germany</td><td>375,782</td></tr><tr><td>6</td><td>Russia</td><td>188,894</td></tr><tr><td>7</td><td>Australia</td><td>367,773</td></tr><tr><td>8</td><td>Italy</td><td>285,021</td></tr><tr><td>9</td><td>Canada</td><td>162,234</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>We can clearly see that the majority of Zynga's user base is based in Western Europe. Judging from the country list Zynga had at least <strong>133,821,870</strong> users based in Western Europe - this number would consume about <strong>64.88%</strong> of users if we compare it against records with duplicates and about <strong>88.99%</strong> of users if we compare it against records without duplicates. Eastern Europe's numbers are much smaller - in this case we can run analysis only on Russia - Russia would consume a mere <strong>0.09%</strong> of the entire user base if compared with records including duplicates and <strong>0.13%</strong> of the entire user base if compared with records without duplicates. Keep in mind that this number could be significantly higher if we would run the analysis on all email domains.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Zynga, counting on the database with duplicates included, had <strong>115,318,761</strong> users with the email length of equal or less than 20 characters and <strong>98,540,978</strong> users with the email length of more than 20 characters.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Zynga also stored passwords hashed and salted with the SHA1DASH algorithm, which, due to the design of the hash, is very difficult to crack.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Registration and last visit dates</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Zynga also stored two types of dates - we can assume that they were dedicated for registration and last visit dates because all of the dates in the second field are at least a few days older than the first field.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Some of the registration dates can be seen below:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><td><strong>#</strong></td><td><strong>Registration year</strong></td><td><strong>User count</strong></td></tr><tr><td>1</td><td>2008</td><td>8,899</td></tr><tr><td>2</td><td>2009</td><td>308,323</td></tr><tr><td>3</td><td>2010</td><td>8,049,512</td></tr><tr><td>4</td><td>2011</td><td>52,509,859</td></tr><tr><td>5</td><td>2012</td><td>45,864,542</td></tr><tr><td>6</td><td>2013</td><td>33,692,947</td></tr><tr><td>7</td><td>2014</td><td>19,797,958</td></tr><tr><td>8</td><td>2015</td><td>11,798,930</td></tr><tr><td>9</td><td>2016</td><td>11,919,813</td></tr><tr><td>10</td><td>2017</td><td>13,229,242</td></tr><tr><td>11</td><td>2018</td><td>9,906,177</td></tr><tr><td>12</td><td>2019</td><td>6,738,581</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>We can clearly see that Zynga started exploding in 2010 - 2011. Presumably because Zynga launched two notable games - <strong>FarmVille</strong> in 2009 and <strong>CityVille</strong> in December 2010. That would also explain how they acquired so many users in 2011.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>We can also look at the months of registration:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>#</th><th>Year and month of registration</th><th>User count</th></tr><tr><td>1</td><td>January 2011</td><td>1,527,898</td></tr><tr><td>2</td><td>February 2011</td><td>3,187,321</td></tr><tr><td>3</td><td>March 2011</td><td>4,811,707</td></tr><tr><td>4</td><td>April 2011</td><td>4,104,531</td></tr><tr><td>5</td><td>May 2011</td><td>3,840,462</td></tr><tr><td>6</td><td>June 2011</td><td>4,251,794</td></tr><tr><td>7</td><td>July 2011</td><td>3,595,167</td></tr><tr><td>8</td><td>August 2011</td><td>4,967,098</td></tr><tr><td>9</td><td>September 2011</td><td>4,969,558</td></tr><tr><td>10</td><td>October 2011</td><td>4,951,815</td></tr><tr><td>11</td><td>November 2011</td><td>4,845,633</td></tr><tr><td>12</td><td>December 2011</td><td>7,456,875</td></tr><tr><td>13</td><td>January 2012</td><td>8,609,520</td></tr><tr><td>14</td><td>February 2012</td><td>6,166,747</td></tr><tr><td>15</td><td>March 2012</td><td>5,616,319</td></tr><tr><td>16</td><td>April 2012</td><td>4,593,770</td></tr><tr><td>17</td><td>May 2012</td><td>3,425,387</td></tr><tr><td>18</td><td>June 2012</td><td>2,914,675</td></tr><tr><td>19</td><td>May 2012</td><td>2,739,815</td></tr><tr><td>20</td><td>August 2012</td><td>2,180,118</td></tr><tr><td>21</td><td>September 2012</td><td>1,960,474</td></tr><tr><td>22</td><td>October 2012</td><td>1,924,118</td></tr><tr><td>23</td><td>November 2012</td><td>2,350,473</td></tr><tr><td>24</td><td>December 2012</td><td>3,383,126</td></tr><tr><td>25</td><td>January 2013</td><td>3,050,625</td></tr><tr><td>26</td><td>February 2013</td><td>2,014,609</td></tr><tr><td>27</td><td>March 2013</td><td>2,964,007</td></tr><tr><td>28</td><td>April 2013</td><td>2,538,785</td></tr><tr><td>29</td><td>May 2013</td><td>5,155,247</td></tr><tr><td>30</td><td>June 2013</td><td>5,620,240</td></tr><tr><td>31</td><td>July 2013</td><td>3,644,162</td></tr><tr><td>32</td><td>August 2013</td><td>2,016,390</td></tr><tr><td>33</td><td>September 2013</td><td>1,595,458</td></tr><tr><td>34</td><td>October 2013</td><td>1,674,013</td></tr><tr><td>35</td><td>November 2013</td><td>1,491,949</td></tr><tr><td>36</td><td>December 2013</td><td>1,927,462</td></tr><tr><td>37</td><td>January 2014</td><td>2,266,956</td></tr><tr><td>38</td><td>February 2014</td><td>2,495,039</td></tr><tr><td>39</td><td>March 2014</td><td>1,526,042</td></tr><tr><td>40</td><td>April 2014</td><td>1,367,953</td></tr><tr><td>41</td><td>May 2014</td><td>1,393,584</td></tr><tr><td>42</td><td>October 2014</td><td>1,736,345</td></tr><tr><td>43</td><td>November 2014</td><td>2,645,285</td></tr><tr><td>44</td><td>December 2014</td><td>1,961,001</td></tr><tr><td>45</td><td>January 2015</td><td>1,649,743</td></tr><tr><td>46</td><td>January 2016</td><td>1,690,730</td></tr><tr><td>47</td><td>May 2017</td><td>1,755,937</td></tr><tr><td>48</td><td>November 2017</td><td>1,841,061</td></tr><tr><td>49</td><td>December 2017</td><td>1,332,390</td></tr><tr><td>50</td><td>January 2018</td><td>1,319,939</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>Now we can take a glance at the last visit dates. First, lets break them down by year:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><td><strong>#</strong></td><td><strong>Year</strong></td><td><strong>User count</strong></td></tr><tr><td>1</td><td>2013</td><td>58,687,929</td></tr><tr><td>2</td><td>2014</td><td>68,633,963</td></tr><tr><td>3</td><td>2015</td><td>14,879,156</td></tr><tr><td>4</td><td>2016</td><td>11,867,841</td></tr><tr><td>5</td><td>2017</td><td>22,641,704</td></tr><tr><td>6</td><td>2018</td><td>16,827,914</td></tr><tr><td>7</td><td>2019</td><td>20,286,276</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>We can clearly see that the vast majority of users last visit dates were in 2014 - Zynga's first quarter results for 2014 showed that daily active user numbers fell from 53 million to 28 million year-over-year, so we can make an assumption that this was a pretty devastating year for Zynga.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Now we can also take a look at the last visit dates including months:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>#</th><th>Year and month</th><th>User count</th></tr><tr><td>1</td><td>December 2013</td><td>58,631,283</td></tr><tr><td>2</td><td>January 2014</td><td>1,233,821</td></tr><tr><td>3</td><td>February 2014</td><td>1,910,625</td></tr><tr><td>4</td><td>March 2014</td><td>12,286,336</td></tr><tr><td>5</td><td>May 2014</td><td>1,286,521</td></tr><tr><td>6</td><td>June 2014</td><td>31,170,789</td></tr><tr><td>7</td><td>July 2014</td><td>1,102,223</td></tr><tr><td>8</td><td>August 2014</td><td>6,064,564</td></tr><tr><td>9</td><td>September 2014</td><td>2,637,421</td></tr><tr><td>10</td><td>October 2014</td><td>2,982,078</td></tr><tr><td>11</td><td>November 2014</td><td>4,074,683</td></tr><tr><td>12</td><td>December 2014</td><td>2,882,402</td></tr><tr><td>13</td><td>January 2015</td><td>2,343,310</td></tr><tr><td>14</td><td>February 2015</td><td>1,519,108</td></tr><tr><td>15</td><td>March 2015</td><td>1,158,878</td></tr><tr><td>16</td><td>October 2015</td><td>1,246,491</td></tr><tr><td>17</td><td>November 2015</td><td>1,212,826</td></tr><tr><td>18</td><td>December 2015</td><td>1,508,320</td></tr><tr><td>19</td><td>January 2016</td><td>1,955,831</td></tr><tr><td>20</td><td>February 2016</td><td>1,447,082</td></tr><tr><td>21</td><td>March 2016</td><td>1,148,311</td></tr><tr><td>22</td><td>April 2016</td><td>1,146,150</td></tr><tr><td>23</td><td>May 2016</td><td>1,227,472</td></tr><tr><td>24</td><td>February 2017</td><td>2,808,792</td></tr><tr><td>25</td><td>March 2017</td><td>2,224,243</td></tr><tr><td>26</td><td>April 2017</td><td>1,705,594</td></tr><tr><td>27</td><td>May 2017</td><td>2,191,226</td></tr><tr><td>28</td><td>June 2017</td><td>3,090,247</td></tr><tr><td>29</td><td>July 2017</td><td>1,960,363</td></tr><tr><td>30</td><td>August 2017</td><td>1,284,560</td></tr><tr><td>31</td><td>October 2017</td><td>1,740,587</td></tr><tr><td>32</td><td>November 2017</td><td>2,426,871</td></tr><tr><td>33</td><td>December 2017</td><td>1,729,112</td></tr><tr><td>34</td><td>June 2018</td><td>1,743,764</td></tr><tr><td>35</td><td>February 2018</td><td>1,183,800</td></tr><tr><td>36</td><td>March 2018</td><td>1,132,668</td></tr><tr><td>37</td><td>May 2018</td><td>1,394,505</td></tr><tr><td>38</td><td>June 2018</td><td>1,634,963</td></tr><tr><td>39</td><td>July 2018</td><td>1,455,900</td></tr><tr><td>40</td><td>August 2018</td><td>1,379,390</td></tr><tr><td>41</td><td>September 2018</td><td>1,409,367</td></tr><tr><td>42</td><td>October 2018</td><td>1,608,628</td></tr><tr><td>43</td><td>November 2018</td><td>1,441,809</td></tr><tr><td>44</td><td>December 2018</td><td>1,489,667</td></tr><tr><td>45</td><td>January 2019</td><td>1,678,076</td></tr><tr><td>46</td><td>February 2019</td><td>1,479,820</td></tr><tr><td>47</td><td>March 2019</td><td>1,850,556</td></tr><tr><td>48</td><td>April 2019</td><td>1,720,382</td></tr><tr><td>49</td><td>July 2019</td><td>3,792,126</td></tr><tr><td>50</td><td>August 2019</td><td>6,817,538</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:heading -->
<h2>Phone numbers</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Alongside email addresses, registration and last visit dates, Zynga also stored phone numbers allowing us to glance at the country calling codes to make further assumptions where Zynga users were based:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><th>#</th><th>Country calling code</th><th>User count</th><th>Country</th></tr><tr><td>1</td><td>3</td><td>164,903,318</td><td>Unknown</td></tr><tr><td>2</td><td>33</td><td>101,870,140</td><td>France</td></tr><tr><td>3</td><td>333</td><td>35,302,909</td><td>France</td></tr><tr><td>4</td><td>334</td><td>54,502,673</td><td>United States (Alabama)</td></tr><tr><td>5</td><td>335</td><td>1,937,399</td><td>United States (Alabama)</td></tr><tr><td>6</td><td>336</td><td>3,791,932</td><td>United States (North Carolina)</td></tr><tr><td>7</td><td>337</td><td>2,815,516</td><td>United States (Louisiana)</td></tr><tr><td>8</td><td>338</td><td>1,980,136</td><td>United States (Kansas)</td></tr><tr><td>9</td><td>339</td><td>1,539,575</td><td>United States (Massachusetts)</td></tr><tr><td>10</td><td>34</td><td>9,679,368</td><td>Spain</td></tr><tr><td>11</td><td>340</td><td>1,096,303</td><td>United States (Virgin Islands)</td></tr><tr><td>12</td><td>343</td><td>1,644,088</td><td>Canada</td></tr><tr><td>13</td><td>344</td><td>1,545,168</td><td>United States (Maryland)</td></tr><tr><td>14</td><td>35</td><td>1,232,958</td><td>Unknown</td></tr><tr><td>15</td><td>36</td><td>26,450,768</td><td>Hungary</td></tr><tr><td>16</td><td>360</td><td>1,225,829</td><td>United States (Washington)</td></tr><tr><td>17</td><td>361</td><td>1,286,462</td><td>United States (Texas)</td></tr><tr><td>18</td><td>362</td><td>1,916,541</td><td>United States (Kansas)</td></tr><tr><td>19</td><td>363</td><td>4,450,702</td><td>United States (Missouri)</td></tr><tr><td>20</td><td>364</td><td>5,034,853</td><td>United States (Kentucky)</td></tr><tr><td>21</td><td>365</td><td>3,738,655</td><td>Canada</td></tr><tr><td>22</td><td>366</td><td>2,105,035</td><td>United States (North Carolina)</td></tr><tr><td>23</td><td>367</td><td>1,726,155</td><td>Canada</td></tr><tr><td>24</td><td>368</td><td>1,838,625</td><td>United States (Louisiana)</td></tr><tr><td>25</td><td>369</td><td>3,127,911</td><td>United States (California)</td></tr><tr><td>26</td><td>37</td><td>12,907,096</td><td>Discontinued, once was assigned to East Germany</td></tr><tr><td>27</td><td>370</td><td>2,669,477</td><td>Lithuania</td></tr><tr><td>28</td><td>371</td><td>2,535,843</td><td>Latvia</td></tr><tr><td>29</td><td>372</td><td>1,402,870</td><td>Estonia</td></tr><tr><td>30</td><td>373</td><td>1,186,081</td><td>Moldova</td></tr><tr><td>31</td><td>38</td><td>10,729,895</td><td>Ukraine</td></tr><tr><td>32</td><td>382</td><td>1,441,145</td><td>Montenegro</td></tr><tr><td>33</td><td>383</td><td>2,060,581</td><td>Kosovo</td></tr><tr><td>34</td><td>384</td><td>1,806,749</td><td>United States (Kansas)</td></tr><tr><td>35</td><td>39</td><td>2,033,093</td><td>Italy</td></tr><tr><td>36</td><td>7</td><td>48,921,308</td><td>Russia</td></tr><tr><td>37</td><td>70</td><td>3,084,166</td><td>United Kingdom</td></tr><tr><td>38</td><td>71</td><td>8,316,024</td><td>Botswana</td></tr><tr><td>39</td><td>716</td><td>1,030,008</td><td>United States (New York)</td></tr><tr><td>40</td><td>717</td><td>1,255,644</td><td>United States (Pennsylvania)</td></tr><tr><td>41</td><td>718</td><td>1,358,479</td><td>United States (New York, excluding Manhattan)</td></tr><tr><td>42</td><td>719</td><td>1,313,189</td><td>United States (Colorado)</td></tr><tr><td>43</td><td>72</td><td>14,019,502</td><td>Serbia</td></tr><tr><td>44</td><td>720</td><td>1,459,595</td><td>United States (Colorado)</td></tr><tr><td>45</td><td>721</td><td>1,323,153</td><td>United States (Saint Martin)</td></tr><tr><td>46</td><td>724</td><td>1,356,205</td><td>United States (Pennsylvania)</td></tr><tr><td>47</td><td>725</td><td>1,357,354</td><td>United States (Nevada)</td></tr><tr><td>48</td><td>726</td><td>1,191,305</td><td>United States (Texas)</td></tr><tr><td>49</td><td>727</td><td>1,611,795</td><td>United States (Florida)</td></tr><tr><td>50</td><td>728</td><td>2,053,585</td><td>United States (Virginia)</td></tr><tr><td>51</td><td>729</td><td>1,777,324</td><td>United States (Colorado)</td></tr><tr><td>52</td><td>73</td><td>10,745,346</td><td>Kazakhstan</td></tr><tr><td>53</td><td>730</td><td>1,698,551</td><td>United States (Illinois)</td></tr><tr><td>54</td><td>731</td><td>1,291,637</td><td>United States (Tennessee)</td></tr><tr><td>55</td><td>732</td><td>1,681,681</td><td>United States (New Jersey)</td></tr><tr><td>56</td><td>733</td><td>2,054,451</td><td>United States (Illinois)</td></tr><tr><td>57</td><td>734</td><td>1,495,079</td><td>United States (Michigan)</td></tr><tr><td>58</td><td>74</td><td>10,492,013</td><td>United Kingdom</td></tr><tr><td>59</td><td>740</td><td>1,013,513</td><td>United States (Ohio)</td></tr><tr><td>50</td><td>743</td><td>1,193,652</td><td>United States (North Carolina)</td></tr><tr><td>61</td><td>744</td><td>1,000,773</td><td>United States (Massachusetts)</td></tr><tr><td>62</td><td>745</td><td>1,151,327</td><td>United States (Florida)</td></tr><tr><td>63</td><td>746</td><td>1,422,644</td><td>United States (New York)</td></tr><tr><td>64</td><td>748</td><td>1,316,537</td><td>United States (New York)</td></tr><tr><td>65</td><td>75</td><td>1,564,523</td><td>Afghanistan</td></tr><tr><td>66</td><td>76</td><td>699,734</td><td>Norway</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>We can see that the most prevalent area code was "3" - it had over 164 million records, so the best guess here would be that this area code was assigned to another area too. We can also clearly see that there was a lot of numbers that were based in different states across the United States, so let's dive into them too:</p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><td><strong>#</strong></td><td><strong>State</strong></td><td><strong>User count</strong></td></tr><tr><td>1</td><td>Alabama</td><td>56,440,072</td></tr><tr><td>2</td><td>North Carolina</td><td>7,090,619</td></tr><tr><td>3</td><td>Kansas</td><td>5,703,426‬</td></tr><tr><td>4</td><td>New York</td><td>5,127,668</td></tr><tr><td>5</td><td>Kentucky</td><td>5,034,853</td></tr><tr><td>6</td><td>Louisiana</td><td>4,654,141</td></tr><tr><td>7</td><td>Colorado</td><td>4,550,108</td></tr><tr><td>8</td><td>Missouri</td><td>4,450,702</td></tr><tr><td>9</td><td>Illinois</td><td>3,753,002</td></tr><tr><td>10</td><td>California</td><td>3,127,911</td></tr><tr><td>11</td><td>Florida</td><td>2,763,122‬</td></tr><tr><td>12</td><td>Pennsylvania</td><td>2,611,849‬</td></tr><tr><td>13</td><td>Massachusetts</td><td>2,540,348</td></tr><tr><td>14</td><td>Texas</td><td>2,477,767</td></tr><tr><td>15</td><td>Virginia</td><td>2,053,585</td></tr><tr><td>16</td><td>New Jersey</td><td>1,681,681</td></tr><tr><td>17</td><td>Maryland</td><td>1,545,168</td></tr><tr><td>18</td><td>Michigan</td><td>1,495,079</td></tr><tr><td>29</td><td>Nevada</td><td>1,357,354</td></tr><tr><td>20</td><td>Tennesee</td><td>1,291,637</td></tr><tr><td>21</td><td>Washington</td><td>1,225,829</td></tr><tr><td>22</td><td>Virgin Islands</td><td>1,096,303</td></tr><tr><td>23</td><td>Ohio</td><td>1,013,513</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>Judging from the analysis above, we can tell that over a quarter - <strong>27.36%</strong> - of the entire user base were apparently from Alabama if we compare the number against a database with duplicates. If we compare the number against the database without duplicates, we would see that users from Alabama consume an enormously huge percentage - <strong>37.54%</strong> - of the whole user base: <em>that's more than some of the states combined.</em></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Now we can also take a look at the rest of the area codes - this time, <em>excluding the United States</em>. Do note that the "Unknown" in the column represents an unusually high amount of users - it's probably a mix between some countries. </p>
<!-- /wp:paragraph -->

<!-- wp:table -->
<figure class="wp-block-table"><table><tbody><tr><td><strong>#</strong></td><td><strong>Country</strong></td><td><strong>User count</strong></td></tr><tr><td>1</td><td>Unknown</td><td>166,136,276</td></tr><tr><td>2</td><td>France</td><td>137,173,049‬</td></tr><tr><td>3</td><td>Spain</td><td>9,679,368</td></tr><tr><td>4</td><td>Canada</td><td>7,108,898‬</td></tr><tr><td>5</td><td>Hungary</td><td>26,450,768</td></tr><tr><td>6</td><td>Discontinued, once was assigned to East Germany</td><td>12,907,096</td></tr><tr><td>7</td><td>Lithuania</td><td>2,669,477</td></tr><tr><td>8</td><td>Latvia</td><td>2,535,843</td></tr><tr><td>9</td><td>Estonia</td><td>1,402,870</td></tr><tr><td>10</td><td>Moldova</td><td>1,186,081</td></tr><tr><td>11</td><td>Ukraine</td><td>10,729,895</td></tr><tr><td>12</td><td>Montenegro</td><td>1,441,145</td></tr><tr><td>13</td><td>Kosovo</td><td>2,060,581</td></tr><tr><td>14</td><td>Italy</td><td>2,033,093</td></tr><tr><td>15</td><td>Russia</td><td>48,921,308</td></tr><tr><td>16</td><td>Botswana</td><td>8,316,024</td></tr><tr><td>17</td><td>Serbia</td><td>14,019,502</td></tr><tr><td>18</td><td>Kazakhstan</td><td>10,745,346</td></tr><tr><td>19</td><td>United Kingdom</td><td>13,576,179</td></tr><tr><td>20</td><td>Afghanistan</td><td>1,564,523</td></tr><tr><td>21</td><td>Norway</td><td>699,734</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:paragraph -->
<p>We can see that the vast majority of Zynga's users came either from the United States or the Western part of Europe.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Summary</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Judging by the entire analysis above, we can draw an assumption that monthly active users of Zynga combined (from the beginning until the time of the breach) were nearing a few billion mark which is very impressive given that the service had its peak sometime in between 2011 and 2013.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Although this data breach, with duplicates included, impacted over 200 million users, Zynga's team had done a very good job protecting the data by hashing the passwords with SHA1 and salts. As already mentioned above, due to its design, this hash is resilient to cracking, so further damage was avoided.</p>
<!-- /wp:paragraph -->