Electronic Arts source code theft via purchased Slack cookie
In June 2021 attackers stole game source code and internal tools from Electronic Arts. They told Motherboard they bought a stolen session cookie for EA's Slack for $10, used it to enter an EA Slack channel, then asked EA IT support for a multifactor authentication token to reach the corporate network; EA confirmed the outline of this account to Motherboard. The data was later dumped after a failed extortion attempt.
- Victim
- Electronic Arts
- Industry
- Gaming
- Country
- United States
- Intrusion began
- Not disclosed
- First disclosed
- Jun 10, 2021
- Actor
- Financially motivated
- Initial access
- Session or token theft
- Identity control that failed
- Session and tokens
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Slack sessions bound to managed devices, and an IT support process that verifies identity before issuing MFA tokens, would have stopped both the cookie replay and the follow-on request.
Go deeper on SWI
- Technique: Session cookie theft
- Technique: Help desk social engineering
Sources
- How Hackers Used Slack to Break into EA Games, Vice Motherboard, Jun 11, 2021
- Electronic Arts hackers say Slack was their secret weapon, Gizmodo, Jun 11, 2021
- Hackers leak full EA data after failed extortion attempt, The Record, Jul 26, 2021
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- CircleCI engineer session token theft and customer secrets exposure 2023 · Session or token theft
- Bybit cold-wallet theft via hijacked Safe{Wallet} developer AWS sessions 2025 · Session or token theft
- Slack private GitHub repositories downloaded with stolen employee tokens 2022 · Session or token theft
- MITRE NERVE network breached via Ivanti zero-days and session hijacking 2024 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). Electronic Arts source code theft via purchased Slack cookie. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2021-electronic-arts-slack-cookie/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.