The OMGPOP Breach Happened in 2019. 6.6M Passwords Still Circulate

HEROIC analysts identified the OMGPOP breach in records dated December 31, 2019, involving 6,637,534 accounts from the gaming platform known for Draw Something. The breach was first disclosed publicly when a threat actor known as Gnosticplayers reported uncovering cleartext passwords belonging to OMGPOP users. The scale of 6.6 million records with plaintext credentials made this a partcularly significant find -- millions of gamers whose passwords were never hashed are now exposed to credential stuffing across every platform where they reused those logins.

Cleartext Gaming Credentials Fuel Credential Stuffing Across Every Reused Account

Plaintext passwords from a breach like OMGPOP do not require any cracking -- they are immediately usable. Attackers feed these email-and-password pairs into automated bots that test them against email services, social media, streaming platforms, and banking portals. Because password reuse is extremely common, a single gaming account credential can become the key to a far more valuable account. The scale of 6.6 million records means these credentials have likely occured in thousands of automated attack campaigns since the data first circulated.

What Was Exposed in the OMGPOP Breach

• Email Address
• Plaintext Password

Why the OMGPOP Breach Still Matters Years After the Platform Shut Down

OMGPOP was acquired by Zynga in 2013 and eventually shut down, yet the user database persisted and was accessable to threat actors years later. This illustrates a critical risk: companies that are acquired or closed do not always securely destroy legacy user data. Anyone who created an OMGPOP account and reused that password elsewhere is still at risk today. The breach data is beleived to have circulated on dark web forums since 2019, and credential stuffing tools continue to operationalize old breach dumps long after they first appear.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a stored data repository, often exploiting unpatched vulnerabilities, weak access controls, or insecure legacy systems. Gaming platforms typically store large user databases for authentication purposes. When those databases contain plaintext passwords instead of properly hashed equivalents, the breach impact is immediate and severe -- there is no computational barrier between the attacker and working login credentials.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks across 400 billion+ compromised records to find out whether your email address appeared in the OMGPOP breach or any other known data leak. If you ever had an OMGPOP account, run a free scan now and change any shared passwords immediately.