EA Games Slack/MFA Social Engineering Breach (2021)

What Happened

In early June 2021, a cybercriminal group breached Electronic Arts' internal network and exfiltrated a large trove of proprietary game development data. The attackers told Motherboard/Vice that they began by purchasing stolen Slack session cookies for $10 on an underground marketplace, using them to access a Slack channel used internally by EA employees. From inside that trusted internal channel, they impersonated an EA employee and messaged IT support claiming to have "lost our phone at a party last night," requesting that a new multi-factor authentication token be issued, a request IT support fulfilled, and did so successfully a second time as well. Armed with valid MFA-backed access to EA's corporate network, the attackers located an internal service used by EA developers to compile games, logged in, created a virtual machine to expand their visibility into the network, and used it to reach another internal service from which they downloaded game source code. The hackers claimed to have taken roughly 780GB of data, including the source code for FIFA 21 and its matchmaking server tools, the source code and debug tools for the Frostbite game engine (used in Battlefield and other EA titles), assorted proprietary frameworks/SDKs, and internal documents. EA confirmed the intrusion publicly on June 11, 2021, characterizing the loss as a "limited amount of game source code and related tools," stating no player data was accessed and no material business impact was expected. On July 14, 2021, EA disclosed that the hackers had made an extortion threat and released a portion of the stolen files publicly; EA maintained that its analysis still showed no material risk to player privacy or its business, and said it continued working with federal law enforcement.

How the Attack Worked

The attackers first purchased stolen Slack session cookies for $10 from an online marketplace and used them to gain access to an EA-used Slack channel, bypassing the need to phish or guess a password since the cookie carried an already-authenticated session. Once inside Slack, posing as a legitimate EA employee, they messaged an IT support staffer and explained they had "lost our phone at a party last night," then asked for a new multi-factor authentication token to be issued so they could log into EA's corporate network. IT support complied, and did so successfully a second time as well. With a freshly issued MFA token and VPN/network access, the attackers found an internal service EA developers use to compile games, logged in, spun up a virtual machine for deeper network visibility, then reached another internal service and downloaded game source code, including FIFA 21 and its matchmaking server code, the Frostbite engine source and debug tools, and various internal frameworks/SDKs and documents.

The Lure & the Tell

There was no phishing email, fake login page, or malicious attachment to catch. The entire pretext played out as a normal-looking internal Slack conversation from an account whose session had been hijacked via a purchased cookie, followed by a verbally plausible helpdesk request ("I lost my phone last night, I need a new MFA token"). The only "tell" was procedural, not visual: EA's IT support accepted a self-reported, unverified identity claim over chat as sufficient grounds to reissue an MFA token, twice, with no independent verification step (callback, manager sign-off, ID check), a process gap rather than a spoofed artifact a user or filter could have flagged.

Outcome

EA publicly confirmed the intrusion on June 11, 2021, stating a "limited amount of game source code and related tools" were stolen, that no player data was accessed, and that it did not expect material impact to its games or business; EA said it made security improvements and was working with law enforcement. The hackers advertised the data (claimed at ~780GB, including FIFA 21 and Frostbite source) on underground forums, initially seeking $28 million. On July 14, 2021, EA disclosed it had become aware of an extortion threat and that a portion of files had been released publicly by the hackers; EA reiterated it saw no material risk to player privacy or its business. A later archived forum post (captured July 26, 2021) attributed to a poster using the name "4c3" and invoking the LAPSUS$ name demanded 10% of the asking price and threatened to release 20-25TB more data if unpaid within 45 days; this later extortion/attribution detail is less firmly corroborated than EA's own confirmed statements. No arrests, indictment, or definitive threat-actor attribution tied to this specific incident were identified in public reporting.

Why It Matters

This incident is a foundational case study in MFA-target social engineering: rather than defeating MFA cryptographically, the attackers defeated the human process surrounding it, a helpdesk willing to reissue a token on a plausible verbal claim with no independent verification, reached via a hijacked internal-chat session rather than any phishing lure. It foreshadows the wave of helpdesk-centric MFA/identity attacks that followed (e.g., Uber 2022, Cisco 2022, MGM Resorts/Caesars 2023), all of which exploit the same weak link: human help-desk verification of identity for credential/MFA resets, rather than technical bypass of the MFA mechanism itself. It also illustrates how a stolen session cookie can be a more direct path into an organization than credential phishing, since it inherits an already-authenticated session and does not require multi-factor login at all.

Defenses

Require out-of-band, multi-factor identity verification before any helpdesk-initiated MFA re-enrollment or token reissuance (e.g., callback to a pre-registered number/device, manager attestation, video/photo-ID check) rather than accepting a plausible story alone; treat "lost device, need new MFA" requests as high-risk and route them through a stricter, logged, non-chat verification workflow; shorten session/cookie lifetimes and bind sessions to device fingerprints so a stolen cookie alone cannot grant durable access; monitor and alert on anomalous session reuse (new IP/geo/device on an existing session token); move toward phishing-resistant, hardware-bound authenticators (FIDO2/WebAuthn security keys) that cannot be "reissued" via a helpdesk conversation the way a soft MFA token can; segment and limit what an authenticated Slack/chat session can reach on the corporate network; monitor underground forums/marketplaces for employee credential and session-cookie sales; run helpdesk staff through social-engineering-resistance training specifically covering pretexts like "lost my phone."