Free tools Windows power users keep installed
One-click scans. No signup required.
Researchers and EA disclosed three different Origin security issues in 2019: a Windows client URL-scheme flaw reported in April, a web authentication and subdomain chain with account-takeover potential reported in June, and a local privilege-escalation flaw addressed in December. The reports describe potential impact and remediation; they do not establish a mass compromise of EA accounts.
How the three Origin security reports differed
| Disclosure | Affected surface and condition | Potential impact described | Remediation or evidence |
|---|---|---|---|
| April 2019 | Origin’s Windows client and its origin:// URL scheme; the app had to be installed. TechCrunch reported the macOS client was not affected. |
Researchers said the scheme could be abused to run an application with the logged-in user’s privileges; the report also discussed possible PowerShell use and access-token theft. | TechCrunch reported EA confirmed a fix had rolled out. [s5] |
| June 2019 | EA web authentication, OAuth single sign-on and a dormant EA subdomain associated with an unused Azure service name. | The researchers said the chain could enable account takeover and identity theft without the player giving login details to an attacker. | Check Point and CyberInt said they disclosed the findings to EA and worked with the company on remediation. [s1] [s2] |
| December 2019 | Origin client software; a valid user with limited permissions also needed to install a specially crafted program or run code modifying part of the software. | Under those specific circumstances, the user could gain privileged-level access. | EA said an Origin client update addressed the issue and that it saw no evidence of exploitation during its investigation and update development. [s3] |
What the June account-takeover finding involved
In its June 26, 2019 technical account, Check Point Research said eaplayinvite.ea.com still pointed through a CNAME record to an Azure service name that was no longer in use. The researchers said they registered that service name and combined the resulting subdomain condition with EA’s OAuth single sign-on and TRUST behavior across EA and Origin domains. Their report describes manipulating a return URI and redirects to capture a single sign-on token. This is a description of the reported vulnerability, not a safe procedure to try.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
![$20 Nintendo eShop Gift Card [Digital Code]](https://m.media-amazon.com/images/I/41XOVFRcBIL._SL160_.jpg)
|
$20 Nintendo eShop Gift Card [Digital Code] | $20.00 | Buy on Amazon |
| 2 |
|
Nintendo eShop Physical Gift Card | $20.00 | Buy on Amazon |
| 3 |
|
Nintendo eShop Physical Gift Card | $50.00 | Buy on Amazon |
| 4 |
![$10 XBOX Gift Card [Digital Code]](https://m.media-amazon.com/images/I/41MEiiMQqmL._SL160_.jpg)
|
$10 XBOX Gift Card [Digital Code] | $10.00 | Buy on Amazon |
| 5 |
|
Fortnite eGift Card | $15.00 | Buy on Amazon |
Check Point and CyberInt characterized the possible result as account takeover and identity theft. Check Point’s June 26 press release said more than 300 million EA gamers could have been exposed. That was a statement about potential exposure—not a count of compromised accounts or confirmed victims. The sources do not document a mass account compromise or quantify confirmed losses.
The press release includes EA’s statement that it engaged its product security response process. Check Point and CyberInt said they reported the issue and worked with EA to fix it. The available reports do not detail every deployed patch or establish the present security status of each historical service or client version.
#1 Best Overall
- This item can be redeemed on eShop only. This item cannot be redeemed on the Wii Shop
- The perfect gift for anyone who loves to play—including you. Choose from over 1,000 new, classic and indie games – delivered directly to your Nintendo Switch, Wii U or Nintendo 3DS family of systems.
- Nintendo eShop Digital Cards are redeemable only through the Nintendo eShop on the Nintendo Switch, Wii U, and Nintendo 3DS family of systems.
- Digital Card balances can be shared across Nintendo Switch, Wii U and Nintendo 3DS family of systems, but may only be used on a single Nintendo eShop account.
Why the December flaw was a different risk
EA’s December 10, 2019 statement concerned local privilege escalation, not the June web-based authentication chain. EA said the flaw required a valid non-Administrator account and either installation of a specially crafted program or execution of code that modified part of the software. EA introduced Restricted Access Mode as part of its response.
EA also said fewer than 5% of Origin users lacked Administrator-level access. That was EA’s historical estimate in its December statement, not a current statistic. Its statement that it saw no evidence of exploitation applies to this specific issue and the investigation described there; it does not establish whether the April or June findings were exploited.
Rank #2
- Nintendo eShop Cards are redeemable only through the Nintendo eShop on the Wii U or Nintendo 3DS family of systems.
- Redemption: Online
- No returns and no refunds on gift cards.
- Give the gift of fun with a Nintendo eShop gift code
- It's easy—apply it to your Nintendo eShop account in seconds.
Were Origin accounts actually hacked, and are users exposed now?
The cited disclosures establish that researchers described vulnerabilities with potentially serious impacts and that EA or the researchers reported fixes or remediation. They do not establish that millions of accounts were taken over. In particular, the “more than 300 million” figure is Check Point’s potential-exposure estimate, not a confirmed victim count.
These are historical 2019 reports. They do not establish the current support status or vulnerability status of every Origin client version or connected service, so they are not enough to conclude that a particular user is exposed—or that every legacy installation is safe today.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #3
- Give the gift of fun with a Nintendo eShop gift code
- It's easy—apply it to your Nintendo eShop account in seconds.
- It ensures that you’ll always have funds on hand to help with purchases of new games and applications
- It’s designed for your Nintendo eShop purchases—no credit card required.
- The perfect gift for anyone who loves to play—including you. Choose from over 1,000 new, classic and indie games – delivered directly to your Nintendo Switch system.
What users and vulnerability reporters can do
Reduce exposure to common account threats
- Check Point and CyberInt advised users to enable two-factor authentication, download or purchase games through official websites, and be cautious with links from unknown sources. These are general precautions, not proof that any one measure prevents the vulnerabilities described above.
Report a vulnerability to EA
EA’s vulnerability-reporting guidance directs researchers to its Coordinated Vulnerability Disclosure form. EA asks for the affected product and platform, the affected version—or the observation time for an online service—what an attacker could do, relevant steps, and supporting evidence such as screenshots or sample code. The guidance page says EA does not currently have a bug bounty program; policy can change, so check EA’s page when preparing a report. [s4]
Quick Recap
Best Value
- Redeemable on accounts in the United States and in U.S. Dollars.
- Gift card must be redeemed at EpicGames.com/redeem. This gift card WILL NOT work if redeemed directly on a console device (PlayStation, Xbox, Nintendo Switch, etc.)
- If you play Fortnite experiences on a console device, you need to link your Epic Games account to your console account(s) so items purchased at Fortnite.com/item-shop appear across all of your linked accounts
- Requires internet connection, valid Epic account and prior acceptance of the terms
- Redemption: Online
Rank #4
- THE PERFECT GAMING GIFT — Buy an XBOX Gift Card for yourself or a friend and let them choose the games, add‑ons, subscriptions, and accessories they want most.
- USE FOR GAMES & CONTENT — Redeem for thousands of digital XBOX games, from backward compatible classics to the latest new releases, plus DLC and in‑game currency.
- GAME PASS READY — Apply your balance toward XBOX Game Pass Ultimate to play new titles on day one* and access a library of hundreds of high‑quality console games.
- PRE‑ORDER & PRE‑INSTALL GAMES — Use your balance to pre‑order and pre‑download upcoming titles so you’re ready to play the moment they launch.
- NO FEES OR EXPIRATION — XBOX Gift Cards never expire and have no service fees, so your balance is ready whenever you are.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
