Zynga headquarters in San Francisco. (Photo: Jason Doiy/ALM)

Social game developer Zynga Inc., the company behind popular mobile games including Words with Friends, has been hit with a class action lawsuit stemming from a data breach that reportedly resulted in hundreds of millions of user accounts being hacked. 

Lawyers at Cotchett, Pitre & McCarthy; Foulston Siefkin; and The Miller Law Firm filed suit Tuesday in the U.S. District Court for the Northern District of California on behalf of a nationwide class of Zynga account holders whose personally identifiable information was stolen in the breach disclosed on the company's website in September. 

That month a hacker known as Gnosticplayers told cybersecurity news website The Hacker News that he breached Zynga's user database and accessed 218 million user accounts. According to the complaint, the hack encompassed personally identifiable information including user names, email addresses, login IDs, password reset tokens, Facebook IDs, Zynga account IDs and passwords stored with outdated cryptography. The breach affected Zynga users that played games including Words with Friends, Draw Something, and OMGPOP, according to the complaint.

The suit claims that Zynga has so far not alerted users via email, an action plaintiffs claim could trigger users to take precautionary steps to prevent further potential damages from the breach. The suit says the company seems to be "far more concerned with protecting itself than with safeguarding the valuable and confidential information of its users."

A company representative didn't respond to a message seeking comment Wednesday. 

The complaint notes that the company opened its September "Player Security Announcement" disclosing the breach by saying: "Cyber attacks are one of the unfortunate realities of doing business today."

Tuesday's lawsuit, brought on behalf of Michigan woman Amy Gitre and a minor from Kansas proceeding under his initials, I.C., seeks to certify subclasses of adult customers and minors. The plaintiffs' lawyers claim that minors are not bound by contractual terms forced upon Zynga users at sign-up. The complaint also claims that Zynga has a substantial number of minor users who are more susceptible to long-term damages stemming from data breaches since they have clean credit histories and tend not to monitor financial activity conducted under their name.

The complaint cites a Carnegie Mellon University study based on identity protection scans of 40,000 U.S. children, which found that the risk of someone using their Social Security number was 51 times higher than that of adults. 

"Based on the common use of mobile games among minors, Zynga was well aware of the economic and reputational value of exploiting children for its own monetary gain, and it should have been equally concerned with protecting the PII entrusted to it by that valuable and relatively defenseless group," the complaint says.