Hackers gained access to the networks of video game giant Electronic Arts (EA) via social engineering, Motherboard reports. The hackers claim to have stolen 780 GB of data, including the source code for the company’s Frostbite game engine.
EA disclosed the breach last week, stating, “We are investigating a recent incident of intrusion into our network where a limited amount of game source code and related tools were stolen. No player data was accessed, and we have no reason to believe there is any risk to player privacy. Following the incident, we’ve already made security improvements and do not expect an impact on our games or our business. We are actively working with law enforcement officials and other experts as part of this ongoing criminal investigation.”
The hackers explained to Motherboard that they’d first gained access to an EA Slack channel using a stolen cookie.
“A representative for the hackers told Motherboard in an online chat that the process started by purchasing stolen cookies being sold online for $10 and using those to gain access to a Slack channel used by EA,” Motherboard says. “Cookies can save the login details of particular users, and potentially let hackers log into services as that person.”
Next, the attackers used the Slack account to message the company’s IT support employees, explaining that they’d lost their phone at a party the night before and needed help getting back into the company’s network. The IT employees sent them a multifactor authentication token that allowed them to log in.
“Once inside EA's network, the hackers found a service for EA developers for compiling games,” Motherboard says. “They successfully logged in and created a virtual machine giving them more visibility into the network, and then accessed one more service and downloaded game source code. The representative for the hackers provided screenshots to help corroborate the various steps of the hack, including the Slack chats themselves. EA then confirmed to Motherboard the contours of the description of the breach given by the hackers.”
New-school security awareness training can help your employees thwart targeted social engineering attacks.
Motherboard has the story.
