Hackers Only Needed $10 and Cookies to Hack Electronic Arts and Steal 780 GB of Data

Electronic Arts suffered a major breach on June 10, 2021, in which hackers stole roughly 780 GB of data, including the source code for FIFA 21, the Frostbite engine, internal development tools, and the company's matchmaking server. The attackers are attempting to sell the material on various forums. The article's central point is that the intrusion was strikingly simple for a publisher of EA's size, relying on inexpensive purchased credentials and social engineering rather than sophisticated technical exploits.

According to Vice, which chatted with the anonymous intruders, the attack began with a $10 purchase of stolen cookies containing login details, which gave access to EA's corporate Slack. The hackers then told the company's support team they had lost their phone at a party and were granted a multifactor authentication token for the corporate network. From there they logged in to EA's game-compilation service and moved into other parts of the network through a virtual machine. EA confirmed to journalists that the hackers' account of their methods was accurate.

Beyond the headline items, the intruders gained access to the technology used to generate digital crowds in the FIFA series, internal documents on in-game AI, and some material related to PlayStation VR. EA stated that no player data was accessed and that it is working with law enforcement and outside experts on an ongoing criminal investigation.

The piece places the incident in a pattern of recent attacks on game publishers. Earlier in 2021, hackers stole source code for Cyberpunk 2077 and other CD Projekt titles, and in November 2020 Capcom suffered a leak of nearly 60 GB of private data. Together these cases point to weak points in help-desk verification and session security across the industry.