In June 2021, Electronic Arts — publisher of FIFA, Battlefield, and The Sims — confirmed thieves had made off with 780 GB of source code and internal tooling. No ransomware, no encrypted servers: just a clean, quiet intrusion that siphoned the company’s most proprietary assets. The breach’s entry point was old-fashioned and deeply instructive: attackers bought a stolen Slack session cookie from a dark-web marketplace for pocket change, reused it to slip into EA’s Slack, and socially engineered IT support into issuing them an MFA token. Legacy authentication snowballed into a half-terabyte crown-jewel theft — the clearest early demonstration that session tokens, not passwords, are now the front door.
Unknown attackers (associated with what later became known as the Lapsus$-style TTP wave) compromised EA in June 2021, stealing approximately 780 GB: Frostbite engine source code, server code for FIFA 21 matchmaking, proprietary SDKs and internal tools. The kill chain combined criminal-market economics with help-desk social engineering: (1) purchase of a stolen Slack session cookie (reportedly ~$10–40 class dark-web goods) from an initial-access broker; (2) cookie used to enter EA’s Slack workspace — MFA never re-challenged the session; (3) posing as an employee who’d lost their phone, the attacker messaged IT support and socially engineered delivery of an MFA token/code; (4) with identity fully assumed, they pivoted into internal networks and exfiltrated code repositories and dev tooling. EA stated no player data was taken; the loss was pure IP. The case became the canonical demonstration that session hijacking defeated MFA, launching the industry’s identity-session protection wave: token binding research, refresh-token revocation practices, phishing-resistant re-authentication (FIDO2/passkeys), and “help-desk MFA reset is an attack path” procedures.
What happened
The intrusion surfaced publicly on June 10, 2021, when the thieves advertised the 780 GB haul on underground forums (RAID forums and a dedicated dark-web post) — including Frostbite engine source and FIFA 21 server code, priced initially around $28,000 and later offered as a whole-network “sale” that never found buyers at their asking figures. EA confirmed the breach days later (June 24 statements): compromised code and tooling, but (critically) no evidence of player-data exfiltration at scale. The attackers later complained publicly that the data was too “hot” to sell — a telling post-script on the resale economics of source-code theft.
The technique breakdown (drawn from the attackers’ own forum posts, first reported by Vice/Motherboard) read like a checklist of then-current gaps: buy stolen Slack cookie; enter workspace; mine it for internal context (employee names, tool names, tone); contact IT support claiming a lost phone; receive MFA codes; authenticate as the employee. Sessions weren’t bound to device or risk signals, and the help desk had no out-of-band verification strong enough to resist a well-prepared impersonation. Every control failed in sequence — precisely the pattern Lapsus$ industrialised against Microsoft, Okta, Uber, and others in 2022.
For EA, direct damage was contained (no encryption, no leak-site extortion of player data), but the strategic exposure — engine source enabling cheat/anticheat arms-race advantage, matchmaking server code, internal tooling — was real IP loss. For the industry, EA became the reference case in every post-2021 identity-security deck: the moment “we have MFA” stopped being an answer.
How it worked
The full chain, from criminal market to exfiltration:
(1) MARKET Purchase — buyer gets stolen EA Slack session cookie
(infostealer-era harvest: browser session store on some
employee's previously compromised machine)
(2) SESSION REPLAY — cookie presented -> Slack workspace entry
no re-auth prompt: session tokens treated as identity proof
(3) INTERNAL RECON — read channels, learn tool names, people,
how IT support talks, what "normal" requests look like
(4) HELP-DESK SOCIAL ENGINEERING — "lost my phone, can't approve
MFA, need code sent" -> IT sends token / performs reset
(5) IDENTITY ASSUMED — full employee auth context now attacker's
(6) PIVOT + EXFIL — internal services + code repos accessed;
780 GB packaged out over time (music, tools, Frostbite,
FIFA 21 server code)Two structural failures stand out. First, session tokens as bearer credentials: a cookie stolen weeks earlier granted live access with no risk-based re-challenge (impossible IP/device shift should have re-authenticated). Second, human-verified identity recovery: the help desk, trained to be helpful, became the weakest authentication factor. Both failure modes now have named control families — token protection/binding (constrained tokens, continuous access evaluation, session risk scoring) and identity-verification hardening for credential resets (verified managers, video checks, wait periods) — that we detail in identity-attack analysis.
Impact and numbers
| Metric | Value | Source |
|---|---|---|
| Volume exfiltrated | ~780 GB (code + tooling) | attacker forum posts |
| Crown assets | Frostbite engine source; FIFA 21 server code; SDKs | ad listings/press |
| Entry vector | Purchased stolen Slack session cookie | attacker account to Vice |
| MFA bypass | Help-desk social engineering for MFA code | same |
| Player data | None confirmed exfiltrated | EA statements |
| Attempted resale | ~$28k initial ask; failed to sell (“too hot”) | forum records/press |
Timeline
| Date | Event |
|---|---|
| 2021-06-10 | Attackers advertise 780 GB EA haul on underground forums |
| 2021-06-24 | EA confirms breach; no player data implicated |
| 2021-07 | Attacker interviews (Vice) detail cookie + help-desk chain |
| 2022+ | Lapsus$ wave reuses playbook at Microsoft, Okta, Uber et al. |
Why it still matters in 2026
EA 2021 was the first large public demonstration of the session-and-support-deck breach pattern that Lapsus$ perfected in 2022 and that remains among the most effective intrusion styles today. Infostealer economies (malware harvesting browser session stores at industrial scale) feed initial-access brokers; help desks remain socially engineerable; and token-replay still works wherever sessions aren’t risk-bound. The defensive wave it catalysed is now baseline in mature programmes: phishing-resistant MFA (passkeys), token binding and continuous evaluation, device-trust on sessions, and hardened identity-verification runbooks for resets. The case also framed source-code theft as its own loss category — IP exposure, cheat-development advantage, and disclosure risk distinct from data-breach liability — prefiguring the 2022–2024 source-theft wave (LastPass-adjacent dev exfil, Okta GitHub repo theft, Microsoft signed-root experiments). When boards ask “we have MFA — are we done?”, the EA chain is the one-slide answer: identity is sessions + recovery paths too, as our identity-threat guide systematic treatment shows.
Detection and hardening takeaways
- Bind sessions to device and risk. Enable session-token protection (Entra ID CAE + token protection, Okta device bindings, continuous risk evaluation) so a stolen cookie is rejected when device/network posture shifts — the single control that would have stopped step 2 of the EA chain.
- Harden the help desk as an authentication surface. MFA resets require out-of-band verification (manager confirmation, video check, enforced delay); script refusal language and train staff that “lost phone” is a classic attack line — it worked at EA, Microsoft, Twitter (2020), and Uber (2022).
- Hunt infostealer exposure. Monitor breach/stealer-log feeds for your domains (HaveIBeenPwned, Hudson Rock, zombie-cookie reports); any session cookie or credential from your org in stealer logs means assume compromise and rotate sessions — not just passwords.
- Revoke-and-invalidate by default. Endpoint malware detection should trigger company-wide session invalidation for affected users (sign-out everywhere, rotate refresh tokens), since cookies live on the endpoint, not the identity provider.
- Treat code repos as tier-1 assets. Egress monitoring on SCM, DLP on large pulls, and per-repo least privilege — 780 GB left through normal developer channels; make “bulk clone” an alarmed event, and segment internal tooling access behind PAM.
FAQ
Why didn’t MFA stop the EA breach?
MFA protects initial authentication, not live sessions or recovery flows. The attackers entered on an already-issued session cookie (no new authentication event to challenge), then obtained an MFA code through the help desk — a recovery flow that trusted human verification. MFA is one control in an identity system; session binding and reset hardening are the complementary layers EA’s breach exposed as missing.
What happened to the stolen EA code?
Largely nothing — the thieves struggled to sell it. The asking price (~$28k starter, higher for the full set) found no buyers because stolen game-engine source is risky to possess, hard to monetise, and useless without EA’s internal infrastructure. The theft’s significance was the intrusion technique, not the resale outcome.
How is this connected to Lapsus$?
The EA intrusion used the same TTPs Lapsus$ industrialised in 2022 — purchased/outsourced initial access, session-cookie replay, help-desk MFA social engineering — against British Telecom, Okta, Microsoft, Uber, Rockstar, and others. Whether the same individuals were involved remains unconfirmed, but the EA case stands as the public debut of the playbook that defined the following year’s breach wave.
