very bad EA customer security [ Edited ]

[NirXF]

I want to play with my friend I kept on inviting him he wont respond even on chat until I joined his squad and my jaw dropped when I saw his rank is now a DIAMOND!!

he was just silver 3 last night I called him through Facebook to congratulate my dude and he responded he didn't even played today coz he had work I WAS LIKE "LAMFAO DUDE HOW?"

I knew it wasn't him coz he wont respond to my invite... told him his account was hacked and he said all his hard earn money bought games were there. also read a lot of same issues that their account was hacked and got banned.

EA... how come these hackers can stole and log in our accounts without notifying us through email???

I don't feel safe in your security anymore gotta remove all EA apps and games.

[Zeelmaekers · Accepted solution]

As a cloud and cybersecurity student, I can say it's pretty hard to hack a modern mobile phone, when it's 5 years old it's just game over, and even loading an image will get you hacked easily. but no hacker is going to do that much effort to only hack your EA account or any other, then it is a targeted attack. I can pretty much confirm it's all phishing now and unsafe practices no targeted hacks.

• Use a password manager (recommend Dashlane)
• When you register just enable 2FA then, which saves you a lot of time.
• Don't click any links in your mail, once they get you, you are on a list and your information is sold, you will receive a lot more scam and phishing emails.
• If you get a lot of junk emails, switch email 

Edit:

I also don't think it's a data breach, one EA should have communicated that they've had now and know when that happened because that player information is possibly worth billions.
And as the law requires they have to inform their customers, the hackers also have to decode the hashes when salted is a pain to do taking a lot of time.

What's also possible but unlikely is a security issue in linking the EA account to the steam account where a man in de middle attack is possible but don't think that is the case.
It would be also pretty difficult to do that.

Thank you for coming to my TED talk.
My name was zeel and remember to keep your account secure 

[SlivPTS]

2 factor authentication enabled?

[E9ine_AC]

@NirXFIt is not the companies fault users do not take 30 seconds of their time to secure the accounts. There are many methods they offer to ensure you would not have this happen. Does this make it the companies fault or the user who owned the account?

Everything you mention can be diverted simply by setting up this security. Long story short. Don't blame someone else for another's mistakes.

Allow me to walk you through this. In order to gain someones, origin and or steam account information means they took measures outside of those 2 clients and compromised themself. You dont magically guess someones login information and password there was more to this then even you understand or your friend. A simple link click can gain access to every single thing on your pc from your bank info to accounts infos. So they most likely could of gained access to the email itself. This is no fault to either side of the clients side of things. 

[NirXF]

2 factor and back up codes...account still compromised 

[NirXF]

@E9ine_ACr u in a cave or somthin? saw a lot of posts abt this on a group today. also he's a software engineer and pc is clean 100% only origin got breached.

[E9ine_AC]

@NirXFAnd the American pentagon has some the most secured servers in the world. Yet its compromised. Yet every military agency in america was compromised. So it does not matter what they do for a living no one is safe.

I highly doubt 2 step was active as it would of sent a text to the phone asking is this you logging in? Once you click no boom they cant log in. It also prompts instantly for a password change. So no sir im not in a cave or something.

I been doing Cyber Security work as well as programming for over 20 years now. Even im not safe. 

[SlivPTS]

@NirXF
Can you tell us your friends Origin username?
Maybe one of Community Managers can check if what you are saying is true, or you just trolling. If hackers are able to get around 2FA, then it's scary.
But if he used same password for email and origin + he set email 2FA, then it's his own fault.

[DarthValtrex]

@NirXF EA does provide two factor authentication. You can learn more about how to enable that at the link below.

https://help.ea.com/en-us/help/account/ea-login-verification-information/

[E9ine_AC]

@DarthValtrex Ohhh he claims they bypassed 2 step and the apex codes. lol Highly unlikely but hey who knows.

[NirXF]

@E9ine_AC oh yeah? how about those streamers and pro's getting hacked lol.