Someone Else got into my EA Origin Account

[SangamonTaylor]

Just figured I'd share this. I created an Origin Account back in the spring when Slickdeals found for me a free copy of ME1 - I'm a big fan of the Mass Effect series. I created the account and redeemed the code but never installed the game. Fast forward to today, I wanted to login and see how the game looks and try the free 10 hours of ME:Andromeda. Had to reset my password to get into my account. Ok, maybe my password is different than I expect. I go into my profile and it prompts me to answer my security questions to continue - they're in Russian. Crap, I think I've been hacked.

I googled this issue, see others have had it too. Follow some links and instructions to get to EA chat. There are 2 phases to getting help.

Phase 1 - automated chat. Computer chats with you and tries to confirm you own the account, wanted me to answer the same Russian security questions I'm trying to reset. Took 25 minutes to get connected to this - it's a computer, why does this take 25 minutes??? I got through it with some yes/no questions and such.

Phase 2 - agent. After you get past automated chat you get connected with an agent. I'm not connected with an agent yet, it's been almost 30 minutes.

EA just doesn't have their sh1t together, do they? I went through a similar experience with russians creating an Uber account with my email address, fixing that took all of about 5 minutes. I am not a fan of Electronic Arts. At all.

/rant

P.S. I have been changing all my passwords and turning on multi-factor authentication on my important things lately. Email, financial stuff, anything that has a "profile" which includes my email adress...

 

[Elixer]

Why do you think it was "hacked"?
More than likely, you used the same passwords on another site, and they got in that way, or your main machine was breached.

Complaining about 30 mins? Try doing that for days on other services.

I would be more worried about your main machine (desktop / phone / laptop / whatever), if they got into multiple accounts.

 

[SangamonTaylor]

Why do you think it was "hacked"?

Because they changed my security questions into ones in Russian. Someone who doesn't own my account got into my account and made changes. What would you call this unauthorized access?

The reason I posted this was partly to vent, and partly because it seems to be happening a lot more. I'm concerned and looking to protect myself and hopefully other people who see stories like this.

Edit to add - I'm pretty confident my desktop/phone are safe, but if you or anyone else reading this have recommendations I'd like to hear them. I trust advice on this forum more than google results when it comes to things like this.

 

[BFG10K]

The reason I posted this was partly to vent, and partly because it seems to be happening a lot more. I'm concerned and looking to protect myself and hopefully other people who see stories like this.

The best protection I've found is to ban the likes of Origin and Uplay. I don't buy or play any such games.

Cloud DRM sucks balls. I've been telling people since 2004 when Steam launched that legitimate customers will get shafted while the pirates just double-click the EXE. As the services lock more and more people into them, the hacks will get worse.

 

[Mai72]

My Steam account is constantly being attacked.

That is why I use Steam authentication, and my Steam password is 12 characters long. Plus, I get notifications when someone is trying to hack my account. It hasn't happened since I've done the steps I just mentioned. Maybe you could do the same with your EA account?

BTW, Check out Safe in Cloud Passowrd Manager. It's currently my favorite. I've been using it for over 2 years now, and it makes saving passwords a snap. The paid version is so worth it.
https://www.safe-in-cloud.com/en/

 

[SangamonTaylor]

It hasn't happened since I've done the steps I just mentioned. Maybe you could do the same with your EA account?

Good advice.

I actually spent a good chunk of time this morning setting up a password vault, securing it and getting my phone, tablet and computer all using it. I then went through all my major online profiles, changed my passwords (longer than 12 characters), enabled TFA and got them into the vault. Steam was one of them. Trying to find minor stuff too - websites I set up an account on and haven't touched in awhile. Good to delete if I can or resecure it.

Also did some reading on securing my phone and my desktop more than I do already.

So far I'm lucky. Nothing seems to have happened to me maliciously.

 

[JSt0rm]

it was me.

 

[SangamonTaylor]

it was me.

Thanks for the kick in the butt to look into this stuff!

 

[JSt0rm]

Thanks for the kick in the butt to look into this stuff!

im pinging your systems

 

[Elixer]

Because they changed my security questions into ones in Russian. Someone who doesn't own my account got into my account and made changes. What would you call this unauthorized access?

The reason I posted this was partly to vent, and partly because it seems to be happening a lot more. I'm concerned and looking to protect myself and hopefully other people who see stories like this.

Edit to add - I'm pretty confident my desktop/phone are safe, but if you or anyone else reading this have recommendations I'd like to hear them. I trust advice on this forum more than google results when it comes to things like this.

Yes, they got access, but, as I said in my original post, that doesn't mean that Origin was hacked, it just means that they got a hold of your information, and logged into Origin and changed stuff.
Did you use a weak password?
Did you use the same password on multiple sites?

Turning on two factor authentication on Origin does help, but, without knowing more about what I asked above, it is hard to say when else you need to do to keep your stuff safe.

 

[lupi]

Think someone was trying to brute force my account, got an email from origin about password being reset due to unusual behavior.

 

[SangamonTaylor]

I changed the thread title based on Elixer's feedback - I think I understand that the way I phrased the post was inaccurate. Sorry for confusion.

In response to the rest of the questions about this - yes, I was using a relatively weak password when someone else got into my account. Not a lot of characters, not enough complexity, I'll leave it at that. I used this password on multiple sites, yes.

Since then I have made some changes on all the major accounts I have with my websites. Longer passwords, more complex, if TFA is available it's now enabled.

 

[you2]

Make sure most accounts have a unique password. The only time I use a simple password is when I don't really care that much if the account is hacked. None of my banks, stores and other things that involve money share a password or (when I have control) user id/email.