A few days ago I received an email from EA stating they reset my password because it may be compromised:
The password for your Origin account was recently reset because a standard systems analysis indicated that your user name and password may have been subject to suspicious activity. We have no reason to believe at this time that the suspicious activity is the result of unauthorised access to EA’s databases. Instead, such activity could be related to issues with phishing, use of weak passwords, logging in from shared connections or even using the same password on multiple websites. We apologise for any inconvenience this may cause you and hope you will recognise we’re taking this action to better protect your personal data.
This happened on the day that my Steam account was hacked and the user changed the email and password for Steam. My Steam account had no EA games on it, but they both used the same email and password.
In my mind that leaves two options of why my password was reset:
- the Steam hacker tried to access my EA account with the same credentials but flagged something likely based on location of log in.
- EA's "standard systems analysis" noticed I had used the same email and password and flagged it.
In my opinion it seems more likely it is #2 because it didn't appear anyone accessed my EA account, there were no signs I had an EA account from Steam, and the email states "using the same password on multiple websites" is a reason for changing.
If it is #2 like I believe it is how could EA possibly know I used the same password on both accounts without not only knowing my EA password but knowing my Steam password as well? If they couldn't know that why would they include that line in their email?