Hackers dump stolen Electronic Arts data after extortion failure
The thieves failed to find a buyer, then failed at extorting EA
The hackers who stole a wealth of data from game publishing giant Electronic Arts (EA) last month have dumped their haul on an underground forum, after failing to extort the firm.
The criminals released the data on 26th July, according to The Record, and it's now being widely distributed on torrent sites.
The Record's analysis of the leaked files found they did indeed contain the source code of for FIFA 21, as had initially been claimed when the hack was announced.
EA declared the data breach on 10th June, with a spokesperson telling Motherboard that only a "limited amount" of data was stolen.
The spokesperson claimed the hackers could not access any player data, and there was no evidence to suggest any risk to player privacy. They added that the security incident was not expected to have any impact on EA's games or business.
The security breach came to light after an individual claimed on a cybercrime forum that they had obtained the source code for FIFA 21 and its matchmaking server, as well as the code and tools for the Frostbite engine.
In all, the hackers claimed to have stolen 780GB of data, which they were willing to sell for $28 million.
In an interview with Motherboard, a representative for the criminals said they purchased stolen authentication cookies for an EA internal Slack channel from a dark web marketplace called Genesis, for $10.
They used the cookies to imitate the account of an already-logged-in EA worker and access the company's Slack channel. After this, they tricked an IT support staffer into granting them access to the company's internal code repositories.
While the hackers had initially hoped to earn huge money by selling EA source code on the underground market, they actually failed to find any buyers.
They then tried to extort EA directly, asking the company to pay an undisclosed sum or have the data leaked publicly online.
On 14th July, the hackers released nearly 1.3GB of source code in the hopes of forcing the gaming firm to pay up.
"Few week ago we send email for ransome [sic] to EA but we dont get any response so we will posting the src [source]," they wrote on a cybercrime forum.
"If they dont contact us or dont pay us we will keep posting it," the hackers threatened.
EA said it was working with federal agencies as part of a criminal investigation, and that it had taken several measures to improve its systems and network security.
In a statement to The Record last week, EA said there was no evidence to suggest that any player's privacy was at risk as a result of the leak.
"Following the incident, we've already made security improvements and do not expect an impact on our games or our business," an EA spokesperson told The Record.
"We are actively working with law enforcement officials and other experts as part of this ongoing criminal investigation."