OMGPOP omgpop.com OMGPOP data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Around 2013, the maker of Draw Something, OMGPOP, suffered a breach, and the data was leaked in 2019. Have I Been Pwned lists 7,071,293 accounts, with email addresses and plain text passwords exposed. It was added to the site in November 2023.
View all 13,118 breaches- Breach date
- Jan 2013
- Affected
- 7,071,293
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
OMGPOP made the game Draw Something. It was formerly known as i'minlikewithyou (iilwy) and was later bought by Zynga. According to Have I Been Pwned (HIBP), the company suffered a data breach in approximately 2013, and the data was later leaked in 2019. HIBP lists 7,071,293 accounts and added them on 20 November 2023.
Sources checked: haveibeenpwned.com, cpomagazine.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
Email addresses paired with passwords in plain text. Plain text means there was nothing to crack.
What it means for you
Anyone holding the file can read your password directly. If you used that password on another account, such as email, shopping or banking, criminals can try the pair there in what is called credential stuffing. Your email address also puts you on lists used for phishing.
Background
HIBP's description links to CPO Magazine's report on the wider Zynga password breach. The breach is old, but any password you reused from that period is worth replacing.
What to do if you were in it
- 1
Change the password and anywhere you reused it
If you used your OMGPOP or Draw Something password on any other account, change it there now, and use a different password for each account. A password manager makes that easy. Start with your email account, since it can reset the others.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your important accounts, starting with email. It blocks most takeovers even when a password has leaked. The FTC lists this among its post-breach steps.
- 3
Expect scam messages
With your email address out there, scammers can send convincing phishing emails and texts. Don't click links in unexpected messages; go to the company's site yourself.
- 4
Check where else your details have leaked
To see which other breaches include your email or phone, run a free Serus scan.
Frequently asked
Was I affected by the OMGPOP breach?
Look up your email on Have I Been Pwned. If OMGPOP is listed, you were among the 7,071,293 accounts.
What was exposed in the OMGPOP breach?
Email addresses and plain text passwords, per HIBP.
Should I change my password?
Yes, if you ever used that password anywhere else. Plain text means anyone with the data could read it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
