EA Data Breach (2021): A $10 Slack Cookie and a Help-Desk MFA Token

The Slack message that worked twice

The line that opened EA's network came from the hackers' own representative, speaking to Motherboard. Once they were in an EA Slack channel, they messaged IT support: "we lost our phone at a party last night." Then they asked for an MFA token so they could log in to the corporate network.

The representative shared screenshots of the chats, and EA confirmed the broad strokes to Motherboard. Every part of that request was a warning sign:

1. The channel. The message came from a Slack account that looked real, because its session was real, just stolen. Being logged in to chat only proves someone has the session. It doesn't prove who they are.
2. The story. A lost phone is the usual reason to skip the old second factor. It's also the easiest story to make up, so it should get the toughest check.
3. The ask. They didn't want help with a forgotten password. They wanted a new MFA token, which means handing over the second factor itself.
4. The repeat. It worked a second time. A second token request for the same account should set off a review, not produce a second token.

How the attackers got from Slack to the source code

1. Credential sourcing. For $10, the hackers bought stolen browser cookies holding a live session for a Slack channel EA used. They later said the cookies came from the Genesis market, according to The Record.
2. Initial access. With the cookie, they were in Slack as an EA user. No login page, no MFA prompt. That's session hijacking, a kind of account takeover.
3. Pretext. Pretending to be that employee, they went to IT support with the lost-phone story.
4. Escalation. IT support issued an MFA token, and that got them onto EA's corporate network.
5. Exfiltration. They found a service EA developers use to compile games, set up a virtual machine to see more of the network, got into another service and downloaded game source code.

Motherboard flagged one detail that may or may not be related. Back in February 2020, researchers had found a list of EA Slack channel names that a former engineer left in a public code repository.

EA data breach timeline

What EA lost, and what it says it didn't

The reset rule that would have stopped it

What failed was the help desk's rule for handing out MFA tokens. A chat message from a logged-in account counted as proof of identity. Tighten that one rule at step 4 and the cookie never matters.

• Verify somewhere else. A callback to a number on file, the manager's OK, an ID check on video. Anything but the chat the request arrived in.
• "Lost my phone" gets extra scrutiny, every time. Two token requests for one account in a short span? Someone should look at that.
• Short cookie lifetimes, with sessions tied to the device. Then a $10 cookie probably doesn't work at all.
• FIDO2 security keys or similar phishing-resistant MFA. A help desk can't type one of those into a chat window.

Where EA fits among help-desk MFA cases

The same pattern comes back in later cases in this library's help-desk and MFA manipulation group. In 2022, an attacker pushed an Uber contractor into approving an MFA prompt (see the Uber 2022 breach). In 2023, callers talked outsourced help desks into resets at Caesars and Clorox.

If you work a help desk: the channel tells you nothing about the sender. If you run security: a stolen cookie walks right past the login page, MFA and all. If you run training: the lost-phone story belongs in every help-desk drill.

Details that are still unconfirmed

• Who did it: there's been no arrest, no charge and no firm attribution for this intrusion. A later forum post used the LAPSUS$ name, but that link is thin.
• The listing date: one report puts the first forum listing at about June 6, 2021. The Record dates the sale thread to June 10.
• The method details: the cookie price, the Genesis source and the two successful token requests all come from the hackers, though EA confirmed the outline.

Reviewed by the SEE Team. This case was written from EA's statements and the reports listed below, and checked against them before release. See how cases are sourced and reviewed and who runs this library.