History
Based in San Francisco, California, RockYou was founded in 2005 by Lance Tokuda and Jia Shen. The company's first product, a slideshow service, was designed to work as an application widget. Later applications included various forms of voice mail, text and photo stylization, and games. As of December 2007, it was the most successful widget maker for the Facebook platform in terms of total installations.[citation needed]
In May 2007, RockYou was one of the companies invited to participate in F8, the event at which Facebook announced an open platform allowing third parties to develop and operate their own software applications on the Facebook website. Applications made for Facebook include Super Wall,[2] "Hug Me", Likeness, Vampires, Slideshows, Birthdays, MyGifts, and Emote, among others.[3]
In December 2009, RockYou experienced a data breach resulting in the exposure of over 32 million user accounts. This resulted from storing user data in an unencrypted database (including user passwords in plain text instead of using a cryptographic hash) and not patching a ten-year-old SQL vulnerability. RockYou failed to provide a notification of the breach to users and miscommunicated the extent of the breach.[4]
In October 2010, the company completed major layoffs.[5] In November 2010, the company's founder and CEO, Lance Tokuda, stepped down from his position as CEO[6] and was later replaced by Lisa Marino in April 2011.[7]
In 2010, RockYou announced the acquisitions of two game development studios, TirNua[8] and Playdemic,[9] as well as development agreements for two new games from John Romero's social game studio Loot Drop.[10] Playdemic's first game, Gourmet Ranch, was nominated in February 2011 for a Mochi Award for Best Social Game. RockYou's investors include SoftBank,[11] Sequoia Capital,[12] Lightspeed Venture Partners,[13] Partech International,[13] and DCM.[13]
In 2011, the company agreed to undergo two independent security audits to settle a proposed class action in California over a 2009 data breach that exposed millions of passwords and email addresses.[14]
In 2012, the company settled Federal Trade Commission charges. The settlement barred future deceptive claims by the company regarding privacy and data security, required it to implement and maintain a data security program, barred future violations of the Children's Online Privacy Protection Act (COPPA) Rule, and required it to pay a $250,000 civil penalty to settle the COPPA charges.[15]
On June 13, 2012, RockYou acquired Bingo developer Ryzing[16] and relocated its headquarters to San Francisco, California.[17] In August 2012, RockYou launched The Walking Dead Social Game based on AMC's hit series of the same name.[18] In April 2014, RockYou purchased three Playdom social games from Disney: Gardens of Time, Words of Wonder, and City Girl, and announced it is licensing Army Attack, Crazy Penguin Wars, Millionaire City, and Zombie Lane from Digital Chocolate.[19]
In 2015, RockYou purchased The Godfather: Five Families, Kingdoms of Camelot, Edgeworld, Glory of Rome, and Dragons of Atlantis from Kabam.
In 2016, RockYou acquired War of Nations from GREE.
In 2019, RockYou closed down its popular but money-losing PurePlay Poker Game without notice. Shortly after, the RockYou corporate website went dark.
In February 2019, after several Facebook posts promoting "exciting news" and a plan to upgrade servers, RockYou announced the closure of The Godfather: Five Families. Players were given 5 days' notice.
On February 13, 2019, RockYou filed for Chapter 7 bankruptcy in U.S. Bankruptcy Court for the Southern District of New York.[20]
Data breach
In December 2009, the company experienced a data breach resulting in the exposure of over 32 million user accounts. The company used an unencrypted database to store user account data, including plaintext passwords (as opposed to password hashes) for its service, as well as passwords to connected accounts at partner sites (including Facebook, Myspace, and webmail services). RockYou would also e-mail the password unencrypted to the user during account recovery. They also did not allow using special characters in the passwords. The hacker used a 10-year-old SQL vulnerability to gain access to the database. The company took days to notify users after the incident, and initially incorrectly reported that the breach only affected older applications when it actually affected all RockYou users.[4]
The full list of passwords exposed as a result of the breach is available in Kali Linux, and has been since its launch in 2013. Due to its easy attainability and comprehensive length, it is commonly used in dictionary attacks.[21]
