ea.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting over 10 million clients and 30,000 employees, primarily driven by historical data breaches and active infostealer logs. The data breach component accounts for 85.3% of the total events, with infostealer logs making up 14.7%. The timeline shows a surge in employee and client data exposure in January 2026, with continued high volumes through June 2026. Malware families like Redline, Rhadamanthys, and LummaC2 are prevalent, suggesting credential harvesting and data exfiltration. The targeted services are predominantly EA's login and account creation endpoints, indicating a focus on user account compromise. The majority of leak repository data originates from combolist sources, suggesting credential stuffing or reuse of compromised credentials. The primary geographical impact appears to be in the United States, followed by Brazil and France. The operating systems most affected are Windows 11 and various Windows 10 enterprise and home editions. Given the high volume of data breaches and active infostealer activity targeting client and employee credentials, this incident poses a critical risk. The prevalence of infostealers and the targeting of login services suggest a high likelihood of account takeovers, financial fraud, and further downstream compromises. Remediation efforts should focus on immediate credential rotation for all affected employees and clients, enhanced multi-factor authentication deployment, and thorough security audits of the targeted login services. Investigating the root cause of the data breaches and infostealer infections is paramount to prevent recurrence.