How a Simple Slack Message Led to One of EA’s Biggest Security Breaches

[igxccom]

Cybersecurity stories can feel distant to everyday players, but a recent incident involving Electronic Arts shows how closely these events connect to the games mobile gamers love. Hackers managed to break into EA’s internal systems using Slack, a common workplace communication tool, ultimately stealing massive amounts of sensitive game development data. While EA confirmed that no player data was accessed, the breach highlights risks that affect the entire gaming ecosystem.

According to details shared with Motherboard, the hackers’ operation began with something surprisingly inexpensive: stolen login cookies purchased online for just $10. These cookies allowed them to access an EA Slack channel by impersonating a legitimate user. Cookies can store login credentials, and in this case, they gave attackers a foothold inside EA’s internal communications.

Once inside Slack, the hackers didn’t rely on advanced malware or brute force attacks. Instead, they used social engineering. They contacted EA IT support through Slack, claiming they had lost their phone at a party and needed help accessing their account. By convincing support staff, they obtained multifactor authentication tokens—successfully, according to the hackers, on two separate occasions.

With valid access to EA’s corporate network, the attackers explored internal developer tools. They located a service used to compile games, created a virtual machine, and gradually expanded their visibility across the network. From there, they downloaded valuable source code, including FIFA 21, matchmaking tools, and the Frostbite engine that powers major franchises like Battlefield. In total, the hackers claim to have stolen 780GB of data, which they later advertised for sale on underground forums.

EA confirmed the scope of the breach and stated that it has already implemented security improvements. Importantly for players, the company emphasized that no player data was compromised and that there is no risk to user privacy. For mobile gamers who invest time and money into EA titles, that reassnce matters.

Still, incidents like this can affect development timelines, internal tools, and long-term trust. Mobile gamers often interact with EA titles through live services, updates, and in-game economies. Many players manage spending carefully Buy EA Gift Cards, which provide a controlled way to access EA content without linking payment details directly. Events like this breach remind players why security matters on both the corporate and consumer sides.

The documents allegedly stolen include materials related to PlayStation VR, AI in games, and how EA creates digital crowds in FIFA. While fascinating from a technical perspective, their exposure underscores how much proprietary knowledge game companies protect behind the scenes.

In the end, this breach wasn’t about weak passwords or outdated software—it was about human trust. As gaming becomes more connected and cloud-based, similar risks will continue to exist. For players, staying informed is just as important as enjoying the latest releases, whether they’re funded through subscriptions, direct purchases, or EA Gift Cards. The games may feel simple on the surface, but the systems behind them are anything but.