EA patches flaw in its Origin platform, used by tens of millions, that could let hackers access all of a user's personal account data without any login details
Danny Palmer / ZDNet :
Context & Ripple Effects
This is the second Origin security fix EA has shipped in as many months: in April, researchers disclosed a remote code execution flaw in the Windows client that exposed players' PCs, and now a separate bug lets attackers pull a user's full personal account data without ever entering credentials. With tens of millions of accounts on the platform, both flaws sit on the same attack surface — the launcher itself rather than the games it distributes.
First-order effects
- Every active Origin user was exposed to silent account-data theft until the patch landed, since the flaw required no login details from the victim.
- EA is pushed into another emergency patch cycle for its distribution client within weeks of the April remote code execution disclosure.
Second-order effects
- A pattern of client-side vulnerabilities makes the launcher — not just the games — a trust liability for EA, giving rival publishers' launchers a security talking point in the battle for where players keep their libraries and payment details.
- Attackers learn that compromising a session beats cracking a password: the same logic resurfaces two years later when EA's own network is breached via stolen cookies bought online for $10 and social-engineered login tokens.
Third-order effects
- Game distribution clients consolidate enormous stores of personal and payment data behind always-on desktop software, making them a standing target class where authentication bypasses and token theft matter more than credential attacks — a shift the 2021 EA data breach confirmed at network scale.
The trend: Game launchers are becoming a primary attack surface, with session hijacking and authentication bypasses displacing password theft as the way into player accounts.