---
title: "Electronic Arts security incident"
description: "What the retained public evidence establishes about the Electronic Arts incident, its attack path, impact, and response."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-09-19"
canonical_url: "https://www.ally.security/incidents/electronic-arts-security-incident-2021"
markdown_url: "https://www.ally.security/incidents/electronic-arts-security-incident-2021.md"
stix_url: "https://www.ally.security/incidents/electronic-arts-security-incident-2021/stix.json"
---

# Electronic Arts security incident

The retained public source describes the Electronic Arts incident as Purchased stolen cookies to impersonate an employee on Slack, then tricked IT into issuing an MFA token. Other material details remain unresolved.

Last modified Sep 19, 2026 · 1 source

## Summary

- **Environment:** Gaming
- **Operational impact:** The reviewed source does not establish a precise operational or data impact
- **Financial impact:** No financial figure is established by the reviewed source evidence

## What happened

In 2021, Electronic Arts experienced an incident in its gaming environment. The retained source describes the attack path as follows: Purchased stolen cookies to impersonate an employee on Slack, then tricked IT into issuing an MFA token. [1](#source-1)

## Impact

- The reviewed source does not establish a precise affected-person count, data scope, or operational consequence.
- No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.

## Timeline

### June 11, 2021 — Documented public update

The [EA statement on June 11 security incident](https://www.ea.com/amp/news/ea-statement-on-june-11-security-incident) records the incident facts used in this briefing. [1](#source-1)

### September 19, 2026 — Briefing updated

This briefing was last reviewed and updated on September 19, 2026.

## Threat Group & Attack Vector

The retained source describes the attack path as follows: Purchased stolen cookies to impersonate an employee on Slack, then tricked IT into issuing an MFA token. The canonical record does not add intrusion steps beyond those supported by the source. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

The reviewed source does not describe containment, notification, or restoration steps in enough detail to summarize them responsibly.

This account is bounded to [EA statement on June 11 security incident](https://www.ea.com/amp/news/ea-statement-on-june-11-security-incident). Details absent from that evidence are left unresolved rather than inferred. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/electronic-arts-security-incident-2021/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### EA statement on June 11 security incident

official · Electronic Arts

<https://www.ea.com/amp/news/ea-statement-on-june-11-security-incident>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Documented public update: 2021-06-11
2. **Resulted In · 82% confidence · current**  
   Electronic Arts security incident: Purchased stolen cookies to impersonate an employee on Slack, then tricked IT into issuing an MFA token.
3. **Affected Organization · 100% confidence · current**  
   Electronic Arts security incident: Electronic Arts
4. **Resulted In · 100% confidence · current**  
   Electronic Arts security incident: The reviewed source documents the electronic arts security incident involving Electronic Arts.

</details>